Join a Winning Team!
Cyber Security Operations Specialist III – SEIM (CS064)
Saint Louis, MO
·
Full time
Cyber Security Operations Specialist III – SEIM
Description
RISA20230227-CS064
Cyber Security Operations Specialist III – SEIM – St. Louis, MO
Position ID: RISA20230227-CS064
FSLA Classification: Exempt
Location: St. Louis, MO (NCW) (63118)
Anticipated Start Date: Immediate Job Opening
Required Security Clearance: Must already possess and be able to maintain an active DoD TS/SCI security clearance.
Must already have or have held SCI within the last 2 years.
Must have the ability to obtain and maintain a CI polygraph within 6 months of start date.
COVID Policy: As directed by Executive Order 14042, all current and newly hired employees are required to be fully vaccinated for COVID-19 and provide proof of vaccination, except where they are legally entitled to an exemption/accommodation.
Description
Summary
The Cyber Security Operations Specialist III / SIEM will provide cybersecurity data analysis services, which designs, develops, builds, tests, configures, employs, operates, integrates, sustains, and refreshes the Security Information Events Management (SIEM) capability (i.e. Enterprise Audit), long-term analytics platform, log aggregation platform, and the cyber threat intelligence capability, signature development and deployment, and reputation management services. This includes the onboarding of all new and existing IT resources and ensuring the correct routing of all audit events to mission partners in accordance with Intelligence Community Standards (ICS) 500-27.
Specific Responsibilities
Essential Functions:
Provide all preventative and corrective maintenance to ensure consistent, reliable, and secure service availability. This includes all actions required to return the service to full operational capability such as vendor RMA processes, removal and proper disposal of broken equipment/software, installation and testing of new equipment/software, and configuration of new equipment/software
Maintain system availability and reliability with a threshold of 99.99%
Detect and ticket degradations (volume/velocity) of all SIEM data flows within 60 minutes of the start of the degradation
Perform day-to-day maintenance, and specific scheduled maintenance activities that result from manufacturers recommended service intervals, alerts, bulletins, available patches, and updates according to agency approved change management processes. This includes maintaining updated documentation, change logs, and service bulletin libraries for all supported equipment and software in the CSOC knowledge management platform
Execute emergency maintenance actions with sufficient urgency to preclude unacceptable outage durations, approved by the Government prior to execution, and coordinated through and approved by CSOC and ESC government management
Perform all development, engineering, testing, integration, and implementation actions necessary for major vendor revisions
Perform continuous engineering assessments to improve the performance, effectiveness, coverage, and maturity of this service.
Retain documentation regarding loss of event logs (e.g. June 5-7th DNS logs were not ingested from SBU and are lost)
Configure all assets assigned to this service within the Government Furnished Information - Software Tools list in accordance with all Federal, DoD, IC, and NGA laws, directives, orders, polices, guidance, procedures etc.
Perform all development, design, engineering, testing, integration, and implementation actions needed for the total integration and interoperability between all applicable assets in the Government Furnished Information - Software Tools list. This includes ensuing all data flows are properly parsed for ingestion/transmission to internal and external automated reporting systems (e.g. JFHQ DoDIN - Joint Incident Management System, DoD CIO - DoD Scorecard/Get to Green reporting, IC CIO - Cybersecurity Performance Evaluation Model reporting, etc.)
Utilize agency approved ticketing systems to document, track, assign, update, and coordinate all engineering, integration, configuration, and maintenance actions
Use various monitoring, analysis, and visualization tools to track effectiveness, status, performance metrics, and other information as needed or required by Government staff and contractors assigned Cybersecurity Operations Services and Cybersecurity Readiness Services
Qualifications
Required Certifications:
· Must have DoDD 8140.01 and DoD 8570.01-M IAT Level II certification. (Note: A minimum of CompTIA Security+ CE is required as a pre-hire requirement.)
CSSP Infrastructure Support certification (Within 6 months of date of hire)
(Note: see below for which certifications qualify – You only require one of the certifications listed under CSSP Infrastructure Support, in addition to CompTIA Security+ CE.)
o If applicant does not already have one of the following certifications, applicant will be allowed six months from job start date to obtain the certification.
CSSP Infrastructure Support
· CEH
· CySA+
· GICSP
· SSCP
· CHFI
· CFR
· Cloud+
· CND
Required Education:
Bachelors Degree in Computer Science or related field
Additional experience may be considered in lieu of a degree
Required Experience/Skills:
A minimum of 6 years of related experience is required
SIEM experience with one of the following ArcSight, ElasticSearch, Splunk, Event Broker, User Behavioral Analysis (UBA)
Experience providing support to Cybersecurity Operations Cell (CSOC) in creating alerting rules
Create SIEM playbooks
Linux (RHEL) Expert (administration and engineering)
Proficient in manipulating SIEM filters to better find and analyze potential malicious/atypical activity and reduce false positives
Experience with content development within ArcSight and Kibana to facilitate Cyber Analysts ability to investigate malicious events
Creation of ArcSight rules based on use cases of malicious events
Tuning and aggregation of queries and filters
Skilled in troubleshooting event flow through Enterprise Audit infrastructure
Skilled in troubleshooting event format and parsing for ingest into data storage and into SIEM tools
Experience with SIEM and Development Projects
Experience with SIEM support for projects and technical exchange meetings
Experience developing and maintaining enterprise audit projects
Preferred Certifications:
N/A
Preferred Education:
N/A
Preferred Experience:
Experience with Data Analytics
Supervisory Responsibilities:
None
Work Environment:
Professional Office Environment; must be able to sit at a desktop or laptop computer for extended periods of time.
Physical Demands:
· While performing the duties of this job, the employee is regularly required to sit, stand, talk, hear and use hands and fingers to operate a computer and telephone.
· Must be able to communicate regularly via telephone and verbally present information to employees, customers and outside vendors.
Work Schedule/Expected Hours of Work:
· Requires ability to work weekends and evening hours as needed
· 40 hours per week (various shifts available and will be discussed during the interview process - you will be assigned one shift and shifts are not rotated)
· The start and end times may actually vary a little from what is listed here.
Day - Shift 0600-1400
Mid - Shift 1400-2200
Eve - Shift 2200-0600
Other Duties:
· This job description is not designed to cover or contain a comprehensive listing of activities, duties and responsibilities that are required of the employee.
· Other duties, responsibilities and activities may change or be assigned at any time with or without notice.
Travel
Travel Estimated: No travel is expected.
Allowances
N/A
Per Diem
Limited to per diem allowed in accordance with the Joint Travel Regulations/Federal Travel Regulations (JTR/FTR) for pre-approved travel if required.
Citizenship
United States Citizenship is required.
About RISA
RISA is an emerging technologies service provider focused on the continuity of network operations and elimination of risk to ensure the confidentiality, integrity, and availability of critical business processes and data. RISA seeks professionals who are excited by technical challenges and driven by the opportunity to use their knowledge, skills, and abilities in helping our customers meet mission requirements. Our success comes from the talent and commitment of our dedicated employees driven in providing valuable services to our customers. Come along for the journey and perhaps you can be part of our growth and success. RISA offers a comprehensive benefits package that includes:
- Medical, Dental, Vision
- Company Paid Life Insurance & Disability
- 401(k) Retirement Savings Plan including both Pre-tax & Roth Contributions
- Paid Time Off (PTO)
- 11 Paid Federal Holidays
RISA is an Equal Opportunity Employer