Threat Detection and Response Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Perform proactive threat hunting utilizing intelligence-driven and hypothesis-based approaches.

• Assess threat actor tactics, techniques, and procedures to detect potential compromises within NIH environments.

• Align adversary behaviors, indicators, and attack patterns with the MITRE ATT&CK framework.

• Deliver threat findings, indicators, and investigations to support RMF activities, risk assessments, POA&M development, continuous monitoring, and cybersecurity governance.

• Oversee security tools, dashboards, and alerts to identify potential threats and suspicious activities.

• Evaluate events from endpoint, network, cloud, and security monitoring platforms.

• Triage security alerts to assess validity, severity, and potential impact.

• Detect indicators of compromise, attack patterns, and emerging threats.

• Escalate significant security events following established procedures.

• Investigate cybersecurity incidents, security events, and unusual activities.

• Carry out forensic reviews of logs, alerts, and system data to identify root causes and scope.

• Synthesize information from various security tools and data sources.

• Record investigation findings, recommendations, and lessons learned.

• Facilitate post-incident reviews and corrective action planning.

• Provide threat and incident information for risk assessments and POA&M management.

• Assist with audit readiness and security assessment activities.

⛳️ Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related discipline.

• At least 5 years of experience in cybersecurity operations, threat detection, security monitoring, incident response, or SOC environments.

• Proficient in utilizing MITRE ATT&CK techniques and understanding adversary behaviors during investigations, threat hunting, or detection tasks.

• Experienced in investigating cybersecurity incidents and analyzing security events.

• Familiarity with cyber threat tactics, techniques, and procedures (TTPs).

• Understanding of Security Operations Center (SOC) processes.

• Knowledge of Incident Response methodologies.

• Awareness of network security concepts.

• Knowledge of endpoint security technologies.

• Familiarity with NIST RMF (SP 800-37).

• Familiarity with NIST SP 800-53 Rev. 5.

• Familiarity with FISMA.

• Familiarity with federal cybersecurity requirements.

• Strong analytical, troubleshooting, and communication abilities.

• Capability to obtain and maintain an NIH Public Trust.

• Preferred: certification in one or more of Security+, CySA+, GCIH, GCIA, CISSP, CEH, GSEC, CASP+, or CISM.

• Preferred experience in supporting NIH, HHS, or other Federal civilian agencies.

• Preferred experience in a SOC environment.

• Preferred knowledge of MITRE ATT&CK Framework methodologies.

• Preferred experience in cloud security operations within Azure, AWS, or Google Cloud environments.

• Preferred familiarity with Continuous Diagnostics and Mitigation (CDM) initiatives.

• Preferred experience in safeguarding healthcare, biomedical, or research-focused environments.

🏝️ Benefits

• Comprehensive medical, dental, and vision coverage.

• Flexible Spending Account for healthcare and dependent care.

• Health Savings Account available for high deductible medical plans.

• Retirement 401(k) with employer matching contributions.

• Open leave policy along with paid holidays.

• Tuition reimbursement program.

• Transportation expense account.

• Employee assistance program.