cyber defense analyst

RealmOne

<div>RealmOne was built on the principle that people matter first and foremost. We believe in providing a strong work/life balance by investing in our employees and encouraging professional and personal growth. We do this by offering exceptional benefits, flexible schedules, and the tools necessary to achieve success through paid training, mentoring, and the opportunity to work alongside top-notch industry professionals.

Join us on this journey as we execute this mission-critical contract providing Cybersecurity Expertise and Risk Management Services!

Your effort and expertise are crucial to the success and execution of this impactful mission that is critical in ensuring mission success through Security Engineering, Risk Management and Assessment, and Insider Threat Analysis, by improving, protecting, and defending our Nation&rsquo;s Security.

Job Description:
<ul>
<li>Uses information collected from a variety of sources to monitor network activity and analyze it for evidence of anomalous behavior. Identifies, triages, and reports events that occur in order to protect data, information systems, and infrastructure. Finds trends, patterns, or anomaly correlations utilizing security-relevant data. Recommends proactive security measures. Conducts analysis to isolate indicators of compromise. Notify designated managers, cyber incident responders, and cybersecurity service provider team member of suspected cyber incidents and articulate the event&rsquo;s history, status, and potential impact for further action in accordance with the organization&rsquo;s cyber incident response plan.</li>
</ul>
The Cyber Defense Analyst 2 shall possess the following capabilities:
<ul>
<li>Use cyber defense tools to monitor, detect, analyze, categorize, and perform initial triage of anomalous activity.</li>
<li>Generate cybersecurity cases (including event&rsquo;s history, status, and potential impact for further action) and route as appropriate.</li>
<li>Leverage knowledge of commonly used network protocols and detection methods to defend against related abuses.</li>
<li>Apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).</li>
<li>Perform advanced manual analysis to hunt previously unidentified threats.</li>
<li>Conduct PCAP analysis.</li>
<li>Identify cyber-attack phases based on knowledge of common attack vectors and network layers, models and protocols.</li>
<li>Apply techniques for detecting host- and network-based intrusions.</li>
<li>Working knowledge of enterprise-level network intrusion detection/prevention systems and firewall capabilities.</li>
<li>Understand the foundations of a hardened windows network and what native services and protocols are subject to abuse.</li>
<li>Familiarity with fragmentation of network traffic and how to detect and evaluate fragmentation related attacks in raw packet captures.</li>
<li>Conduct network &ndash; traffic, protocol and packet-level &ndash; and netflow analysis for anomalous values that may be security-relevant using appropriate tools.</li>
<li>Understand snort filters and how they are crafted and tuned to feed IDS alerting.</li>
<li>Understand system and application security threats and vulnerabilities to include buffer overflow, SQL injection, race conditions, covert channel, replay and return-oriented attacks, malicious code and malicious scripting.</li>
<li>Analyze malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information.</li>
<li>Perform event correlation using information gathered from a variety of sources within the enterprise to gain situational awareness and determine the effectiveness of an observed attack.</li>
<li>
Familiar with indications of Command and Control (C2) channels and what strategies attackers use to bypass enterprise defenses from a compromised host. 
<div></div>
</li>
</ul>Qualifications:
<ul>
<li>Four (4) years of demonstrated experience as CDA in programs and contracts of similar scope, type, and complexity required. A technical bachelor&rsquo;s degree from an accredited college or university may be substituted for two (2) years of CDA experience on projects of similar scope, type, and complexity.</li>
<li>One (1) year of demonstrated and practical experience in TCP/IP fundamentals.</li>
<li>One (1) year of demonstrated experience with tcpdump or Wireshark.</li>
<li>Two (2) years of demonstrated experience using security information and event management suites (such as Splunk, ArcSight, Kibana, LogRhythm).</li>
<li>Two (2) years of demonstrated experience in network analysis and threat analysis software utilization.</li>
<li>Two (2) years of demonstrated experience maintaining or managing Cloud environments such as Microsoft Azure, Amazon Web Services (AWS), using tools like Microsoft Sentinel.</li>
</ul>
Certifications Required:
<ul>
<li>Requires DoD 8570 compliance with CSSP Analyst baseline certification.</li>
<li>Requires Information Assurance Technical (IAT) Level I or Level II certification.</li>
<li>Requires Computing Environment (CE) certification.</li>
<li>Requires successful completion of the Splunk software training course &ldquo;Fundamentals 1&rdquo;.</li>
</ul>
Position requires active Security Clearance with appropriate Polygraph
Pay Range: 176,000-227,000
<div>The RealmOne pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Our approach to crafting offers considers various factors to establish an equitable and competitive compensation package. These considerations include, but are not limited to, the extent and intricacy of the role&rsquo;s responsibilities, the candidate&rsquo;s educational background, their work experience, and the specific competencies crucial for success in the role.

RealmOne Benefits:
<ul>
<li>Healthcare Coverage + Insurance: Medical: Three (3) rich healthcare options through CareFirst with 100% or majority company-paid premiums. Tax-advantaged health savings account available with generous employer contribution. Dental + Vision: 100% employer-paid for employees and family, with a buy-up option available.</li>
<li>Retirement + Savings: 401K &ndash; 10% TOTAL CONTRIBUTION &ndash; 5% safe harbor &ndash; 5% annual profit share (both immediately vested!).</li>
<li>Paid Time Off + More: 4 weeks starting PTO &ndash; 11 federal holidays + 2 floating holidays &ndash; Paid hours for company-required training.</li>
<li>Career Growth + Development: Access to FREE 24/7 learning via Udemy &ndash; Opportunities to participate in tech councils, industry initiatives, etc. &ndash; $7,500 annual Educational &amp; Professional Development Assistance.</li>
<li>MORE BENEFITS&hellip;FOR EVERY LIFESTYLE! &ndash; Paid parental leave &ndash; Adoption assistance &ndash; Annual swag drops &ndash; Flexible work schedules -Generous referral bonus program &ndash; Employee appreciation + family-friendly corporate events &hellip;and much more.</li>
</ul>
ABOUT US
<ul>
<li>RealmOne is a mid-sized science and technology company dedicated to solving our customers&rsquo; toughest mission challenges.</li>
<li>Headquartered in Columbia, MD., RealmOne supplies advanced cybersecurity, data science, and software engineering services and products to customers in the Government and commercial sectors.</li>
<li>RealmOne delivers encompassing mission assurance and critical systems support to government customers across various U.S. locations to include Colorado, Georgia, Hawaii, Texas, Utah, and Virginia.</li>
<li>RealmOne has won numerous awards, including Top Workplaces by the Baltimore Sun. Across more than 20 prime contracts, RealmOne is a premier innovator for the Government and Department of Defense, and our team is located across the United States.</li></ul></div></div><div></div>

Cyber Defense Analyst 2 (CDA2)

NIKE

<div>WHO WILL YOU WORK WITH
This role reports into the Cybersecurity Incident Response team within Corporate Information Security.
WHO ARE WE LOOKING FOR
We&rsquo;re looking for a Senior Cyber Security Analyst. This role on the team will include leveraging knowledge of industry best practices, good judgment and problem-solving skills to execute Nike security operations. Being on Nike&rsquo;s front lines of defense, the Senior Cyber Defense Analyst is adept at making good decisions under pressure and be able to quick adapt to any security challenge. This individual also pays attention to detail and is disciplined in documenting process and procedures. The Senior Cyber Defense Analyst will also be Shift Lead (2nd tier support) for all requests coming into the department making sure departmental SLAs are met. The ideal candidate believes in operational excellence, continual process improvement and customer service.
WHAT WILL YOU WORK ON
If this is you, you&rsquo;ll be working with the Cybersecurity Incident Response team and performing these key tasks:<ul><li>
Perform log analysis and correlate disparate datasets to identify abnormal behavior.</li><li>
Respond to security events, driving issues to closure, and engaging all appropriate resources.</li><li>
Document Security process and procedures.</li><li>
Support service request in-take process and communicate back to requestors promptly</li><li>
Provide enforcement of security policies, standards and procedures</li><li>
Staying current on security technologies, trends, standards and best practices</li><li>
Continually update skills</li><li>
Other duties and responsibilities as assigned</li></ul>
WHAT YOU BRING
<ul><li>Bachelor&rsquo;s degree in computer science or related field, or equivalent work experience</li><li>
Five years of information technology experience with three years in an information security-related role</li><li>
Solid knowledge of information security principles and practices</li><li>
Minimum five years of security monitoring experience and incident response activities; preferably within a professional services firm or similar environment</li><li>
Strong knowledge of incident response and crisis management with the ability to identify both tactical and strategic solutions using strong verbal and written communication skills</li><li>
Cloud security knowledge and skills; securing cloud environments as well as detecting and responding to cyber security incidents in the cloud</li><li>
Log (network, security, access, OS, application, etc.) analysis skills and experience in relation to identifying and investigating security incidents</li><li>
Proficiency with Linux/UNIX, Windows, and/or Mac OSX</li><li>
Understanding of application security and dev-sec-ops</li><li>
Coding/scripting experience (PowerShell, Python, Ruby, Java, VB Scripting etc.)</li><li>
Malware analysis, virus exploitation and mitigation techniques experience.</li><li>
Comfortable with interfacing with other internal or external organizations regarding security policy and standards violations, security controls failure and incident response situations</li><li>
Understanding of network, desktop and server technologies, including experience with network intrusion methods, network containment, segregation techniques and technologies such as Intrusion Detection Systems (IDS) and Intrusion Protection Systems (IPS)</li><li>
The ability to learn and apply new concepts quickly</li><li>
Resolves problems independently and/or through a support team.</li><li>
Ability to balance and prioritize work</li><li>
Must be trustworthy in keeping sensitive data confidential</li></ul>
One or more of the following professional certifications preferred, but not required:<ul><li>
Certified Information Security Professional (CISSP)Global Information Assurance Certifications (GIAC)</li><li>
Speaking a language in addition to English preferred, but not required</li></ul></div>

Senior Cyber Defense Analyst, ITC

Booz Allen Hamilton

<div>Cyber Defense Forensics Analyst
The Opportunity:
As a security operations center analyst, you&rsquo;re in the middle of the action, responding to and mitigating threats in real time. You&rsquo;re the first line of cyber defense for your organization, and they look to you for guidance on best practices and security measures. We need a SOC analyst like you to help us secure critical infrastructure from the constant onslaught of cyber-attacks.
As an analyst on our team, you&rsquo;ll develop network defense skills as you learn to monitor, detect, and analyze threats by interacting directly with affected users and leveraging state-of-the-art technologies.
When an incident is detected, you&rsquo;ll work with the team to collect data to help incident response understand and mitigate the threat. You&rsquo;ll analyze alerts to figure out just how many systems are affected and initiate recovery efforts. You&rsquo;ll contribute to assessments and learn how to analyze patterns to understand attackers&rsquo; goals to stop them from succeeding. This is a great opportunity to hone your cybersecurity skills and learn more about threat assessment and incident response.
Work with us as we secure against malicious actors.
Join us. The world can&rsquo;t wait.
You Have:<ul><li>
Experience conducting digital forensics or incident response investigations within classified DoD environments</li><li>
Experience with forensic tools such as EnCase, FTK, Autopsy, Cellebrite, Volatility, or X-Ways</li><li>
Experience with SIEMS such as Splunk or ArcSight</li><li>
Knowledge of Windows, Linux, and network forensic artifacts, including memory and disk analysis</li><li>
Ability to identify, triage, and report events that occur to protect data, information systems, and infrastructure</li><li>
Ability to collect, preserve, and analyze evidence in accordance with DoD or federal chain-of-custody standards</li><li>
Ability to find trends, patterns, or correlations in security data</li><li>
TS/SCI clearance</li><li>
Bachelor&rsquo;s degree in a CS, Cybersecurity, or Digital Forensics field</li><li>
DoD 8140 baseline Level II Certification such as Security+, CySA+, CISSP, or DoD Cyber Workforce Framework Certification</li></ul>
Nice If You Have:
<ul><li>Experience supporting Cyber Protection Teams (CPTs), Defensive Cyber Operations (DCO), or Air Force cyber missions</li><li>
Experience with Elastic, Splunk, Wireshark, or MISP for multi-source data correlation</li><li>
Knowledge of malware analysis, reverse engineering, or memory forensics</li><li>
Ability to prepare and brief forensic findings to commanders or senior decision-makers</li><li>
Master&rsquo;s degree in Digital Forensics, Information Assurance, or Cybersecurity</li><li>
GCFA, GCFE, CHFI, or CEH Certifications</li></ul>
Clearance:
Applicants selected will be subject to a security investigation and may need to meet eligibility requirements for access to classified information; TS/SCI clearance is required.
Compensation
At Booz Allen, we celebrate your contributions, provide you with opportunities and choices, and support your total well-being. Our offerings include health, life, disability, financial, and retirement benefits, as well as paid leave, professional development, tuition assistance, work-life programs, and dependent care. Our recognition awards program acknowledges employees for exceptional performance and superior demonstration of our values. Full-time and part-time employees working at least 20 hours a week on a regular basis are eligible to participate in Booz Allen&rsquo;s benefit programs. Individuals that do not meet the threshold are only eligible for select offerings, not inclusive of health benefits. We encourage you to learn more about our total benefits by visiting the Resource page on our Careers site and reviewing Our Employee Benefits page.
Salary at Booz Allen is determined by various factors, including but not limited to location, the individual&rsquo;s particular combination of education, knowledge, skills, competencies, and experience, as well as contract-specific affordability and organizational requirements. The projected compensation range for this position is $55,300.00 to $126,000.00 (annualized USD). The estimate displayed represents the typical salary range for this position and is just one component of Booz Allen&rsquo;s total compensation package for employees. This posting will close within 90 days from the Posting Date.
Identity Statement
As part of the application process, you are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.
Work Model 
Our people-first culture prioritizes the benefits of flexibility and collaboration, whether that happens in person or remotely.<ul><li>
If this position is listed as remote or hybrid, you&rsquo;ll periodically work from a Booz Allen or client site facility.</li><li>
If this position is listed as onsite, you&rsquo;ll work with colleagues and clients in person, as needed for the specific role.</li></ul>
Commitment to Non-Discrimination
All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local, or international law.</div>

Cyber Defense Forensics Analyst

bs-group

Work closely with other technical, incident management, and security analysts to develop a fuller understanding of cyber threat actor s intent, objectives, and activities of cyber threat actors and define a world-class cyber defense program. <ul> <li>Conduct research and evaluate technical and all-source cyber intelligence to develop in-depth assessments of threats to the organization s networks, systems, users, and data.</li> <li>Ensure effective execution of the risk management framework by managing relationships with key stakeholders within strategic business groups and technology.</li> <li>Verify that IT risks are appropriately mitigated and lead multiple stakeholders in agreement on appropriate solutions/controls</li> <li>Create technical assessments and cyber threat profiles of current events based on the inventive collection and research using classified and open information sources to enable advanced threat intelligence</li> <li>Develop, track, and report on Key Risk Indicators (KRIs) for information technology.</li> <li>Monitor, track, and report mitigation and resolution of IT risks.</li> <li>Perform process-level walkthroughs, control testing, etc. for the identification and assessment of IT risks and controls.</li> </ul> Have a bachelor s degree in IT or computer science. <ul> <li>Have 5+ years of IT experience within a similar role.</li> <li>Have professional certifications like CISSP, CISM, CISA, or CRISC.</li> <li>Understand key technology concepts such as access control, confidential data, encryption, business continuity, info-sec scans, and vendor apps.</li> <li>Have a strong knowledge of IT organization business processes and systems including (IT Security, data management, architectural and planning, technology life cycle management, regulatory concerns).</li> <li>Have a strong communication skill to work effectively with employees at all levels of the organization.</li> <li>Have excellent problem-solving skills and the ability to be highly productive, working alone and as part of a team.</li> </ul>

IT Risk & Threat Analyst

SAIC

<div>Job ID: 2511436
Location: PEARL HARBOR, HI, US
Date Posted: 2025-11-10
Category: Cyber
Subcategory: Cybersecurity Spec
Schedule: Full-time
Shift: Day Job
Travel: Yes, 10 % of the Time
Minimum Clearance Required: Secret
Clearance Level Must Be Able to Obtain: None
Potential for Remote Work: No 
Description
SAIC is seeking qualified Cybersecurity Analyst for an Air Force TENCAP HOPE 2.0 contract at Joint Base Pearl Harbor Hickam, Hawaii. 
The Cybersecurity Analyst will:<ul><li> Perform network security monitoring and incident response for a DoW customer.</li><li> Support the sustainment of the accredited cybersecurity posture of domain enclaves by actively tracking and maintaining each network&rsquo;s cyber-vulnerability level and system compliance with applicable Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs). Report any deviations or shortfalls to the Information System Security Manager (ISSM) for action.</li><li> Support and assist with the STIG/SRG checklist process, tracking automated compliance scans and manual STIG checklists based on DISA releases. Validate results and track/report compliance of configuration changes based on CYBERCOM tasking orders or other DoW short-notice threat response notifications.</li><li> Maintain lists of active hosts on different networks and the corresponding basic inventory listings of software used to determine STIGs and/or SRGs that need to be applied.</li><li> Assist in researching configuration updates/changes and apply a &ldquo;patch-and-test&rdquo; approach to determine if a particular configuration update/change will have a detrimental effect on the processes and mission to decide on application in the operational environment.</li><li> Provide comprehensive cybersecurity support in support of Modeling and Simulation / Live, Virtual, and Constructive (M&amp;S/LVC) information technology systems.</li><li> Provide comprehensive support to scan and remediate networks.</li><li> Provide comprehensive support to security monitoring and detection of unauthorized access.</li><li> Develop and execute Government approved security policies, plans, and procedures, implement data network security measures, operate and monitor network intrusion detection and forensic systems, conduct IS security incident handling, support Continuity of Operations Plan/Disaster Recovery (COOP/DR) plans, and perform certification of IS and networks. Provide technical support for Plan of Action and Mitigation process and remediation activities.</li><li> Provide comprehensive support to obtaining and maintaining Authority to Operate (ATO) accreditation for networks and systems.</li><li> Provide other related support including but not limited to:</li><li> Review system artifacts and documents for accuracy.</li><li> Conduct facility visits to observe the actual processes related to each Information Assurance (IA) control (technical, personnel, operational, or management).</li><li> Report security findings and issues associated with the RMF process to the appropriate Cybersecurity POCs.</li><li> Support and coordinate necessary documentation submissions for network and system Interconnection Security Agreements (ISAs), Authority to Connect (ATC), or other security agreements for both persistent and event-based interconnections.</li><li> Participate in meetings with system Information Assurance Security Officers (IASOs), Program Managers (PMs), Information System Security Managers (ISSMs) and their representatives, and other cybersecurity representatives of unit driven events or initiatives. During these meetings present issues and recommendations. Provide meeting reports that outline the discussion topics, problem areas, action items, and resolution recommendations.</li><li> Support system administration personnel with other related functions to include but not limited to implementation and sustainment of cybersecurity best practices in accordance with DoW and DISA directives to maximize confidentiality, integrity, and availability of the networks and training mission.</li><li> For scheduled and unscheduled cybersecurity posture audits, report observations, findings, and any corrective actions applied or recommended. Provide relevant metrics on results of audits, identifying trends and recommendations to reduce vulnerabilities and maintain or improve system security posture.</li></ul>
Qualifications
Experience and Qualifications:<ul><li> Bachelor's and 9, or relevant years of experience in lieu of degree. Must be a US Citizen and currently possess a Secret Security Clearance.</li><li> DoW 8140.03 Foundational Qualification for and Intermediate Level, Vulnerability Analyst Certification.</li><li> Detailed understanding of DoW cybersecurity policies and procedures, including FIPS 199, FIPS 200, NIST 800-53, DHS 4300A SSH, and other applicable policies.</li><li> Comprehensive knowledge of Physical Security principles, methods, and techniques.</li><li> Proficient in operating and configuring ACAS, HBSS, and vulnerability scanners.</li><li> Proficient using MS Office including Word, PowerPoint, Excel, SharePoint, and Teams.</li></ul> 
Desired Experience and Qualifications:<ul><li> Operating system certification (i.e., Microsoft Certified Solutions Expert and/or Red Hat Certified System Administrator).</li><li> Microsoft Windows environment, UNIX, Linux, , VMWare, VDI zero client architecture.</li><li> Microsoft Certified Solutions Craftsman: Server Infrastructure and/or Red Hat Certified System Administrator.</li><li> Certified Information Systems Security Profession (CISSP) or CompTIA Advanced Security Practitioner (CASP).</li></ul> 
Target salary range: $120,001 - $160,000. The estimate displayed represents the typical salary range for this position based on experience and other factors.</div>

Cybersecurity Analyst

Peraton

<div>About Peraton 
Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world's leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees do the can't be done by solving the most daunting challenges facing our customers. Visit peraton.com to learn how we're keeping people around the world safe and secure. 
 
Program Overview 
Provide experienced analysts that will deliver network and exploitation analysis to secure and defend vital networks, and accelerate the nation's ability to meet the challenges posed by an increasingly complex global security environment. 
 
About The Role 
 
Next Generation Digital Network Exploitation Analyst (DNEA4)
 
 
Location: Annapolis Junction / Fort Meade, MD 
 
Clearance: Active TS/SCI with Polygraph Required
 
 
Protect what matters most.
 
Peraton's Cyber Mission business unit provides mission-critical SIGINT and Cyber expertise to the Intelligence Community. Join a team of elite professionals developing next-generation cybersecurity and intelligence solutions that safeguard our nation's most vital networks.
 
 
What You'll Do
 
 
As a Digital Network Exploitation Analyst, you'll apply advanced analytical and technical skills to identify, map, and exploit target networks. Your work will help strengthen and enable critical national security missions. Responsibilities may include:
 
 
<ul><li>Evaluate target networks using all-source intelligence to identify vulnerabilities and develop detailed exploitation and operations plans.
</li><li>Analyze SIGINT and cyber data across multiple layers of the OSI model.
</li><li>Apply deep knowledge of IP core infrastructure, communication devices, and network traffic behaviors.
</li><li>Develop and share new tradecraft as technologies evolve.
</li><li>Collaborate with government, military, and contractor partners to align intelligence needs and mission priorities.
</li><li>Synthesize and communicate insights and findings to mission stakeholders and intelligence consumers.
</li></ul> 
Qualifications 
 
What You Bring
 
 
<ul><li>Experience:
</li><li>15 years experience without a degree, OR
</li><li>13 years experience with an Associates degree, OR
</li><li>11 years experience with a Bachelors degree, OR
</li><li>9 years experience with a Masters degree, OR
</li><li>7 years experience with a PhD
</li><li>Background in one or more of the following: systems design, software/hardware engineering, cybersecurity, network security, vulnerability analysis, penetration testing, digital forensics, or network administration.
</li><li>Proven experience analyzing SIGINT and cybersecurity data and mapping target networks.
</li><li>Completion of JCAC (Joint Cyber Analysis Course) may be considered equivalent to a technical associates degree or it may count towards experience requirement of 6 months.
</li><li>Foreign language proficiency (DLPT-verified) may also be considered relevant experience.
</li><li>Active TS/SCI with current polygraph is required.
</li></ul> 
Preferred Qualifications
 
 
<ul><li>Strong grasp of logical/physical IP core infrastructure and how devices interconnect across networks.
</li><li>Experience developing new analytic tradecraft to meet evolving mission challenges.
</li></ul> 
Why Join Peraton
 
 
Peraton offers enhanced benefits to employees supporting this critical National Security mission:
 
 
<ul><li>Subsidized benefits for employees and dependents
</li><li>25 days PTO annually with a generous accrual cap
</li><li>Attractive bonus plan tied to mission performance
</li></ul>#AJCM
 
 
#NextGenFF
 
 
SCA / Union / Intern Rate or Range 
 
Details 
 
Target Salary Range: $146,000 - $234,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual's experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.
 
 
EEO: Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.</div>

Digital Network Exploitation Analyst (DNEA), Advisor

XiFin

<div>Are you interested in harnessing technology and AI to transform healthcare?
 At XiFin, we believe a healthier, more efficient healthcare system starts with strong financial and operational foundations. Our innovative technologies help diagnostic providers, laboratories, and healthcare systems manage complexity, drive better outcomes, and stay focused on what matters most: patient care.
We&rsquo;re on a mission to simplify the business side of healthcare&mdash;and we know that mission takes people from all backgrounds and experiences. Whether you&rsquo;re early in your career or bringing years of expertise, we welcome your perspective, your curiosity, and your passion. We value individuals who ask questions, challenge the status quo, and want to grow while making a real difference.
About the Role
The Cyber Security Analyst will analyze, evaluate, and tune SIEM events and alerts, threat hunting, automating investigation tasks, and conducting incident response when a security incident arises. Focus on identifying, researching, and performing offensive cyber security tactics and techniques to test and verify preventative and detective security controls.
Work as a key member on project teams to ensure security by design principles are implemented in every IT and development effort, to ensure the effective and appropriate use of security technology solutions and processes that reduce risk and increase the security of the company and its data. Build relationships and partner across the organization and work with team members inside and outside of the department.
How you will make an impact:<ul><li>
Conducting incident response investigations from escalated incidents across Windows and Linux systems, and supporting all phases of the incident response process.</li><li>
Developing, documenting, and testing incident response playbooks and runbooks;</li><li>
Performing cybersecurity forensic analysis, including artifact collection, malware analysis, and timeline reconstruction;</li><li>
Assessing and prioritizing vulnerabilities based on risk factors and exploitability, coordinating remediation efforts, and investigating potential signs of compromise;</li><li>
Understanding and evaluating emerging threats on cyber security exploits, vulnerabilities, tactics, and techniques;</li><li>
Developing detection logic across SIEM environments using the ADS framework and mapping detections to MITRE ATT&amp;CK;</li><li>
Analyzing and tuning SIEM alerts, operating system logs, and security events to improve detection capabilities;</li><li>
Participating in and conducting threat hunting and threat assessment in the context of information technology architecture;</li><li>
Utilizing offensive security tools, including Breach and Attack Simulation (BAS) solutions, to enhance detection capabilities and identify gaps in the organization's defenses;</li><li>
Designing, documenting, validating, and testing security hardening configurations in line with CIS Benchmarks and organizational standards;</li><li>
Conducting software risk assessments for desktop applications and browser extensions to identify potential security concerns and ensure compliance with organizational policies;</li><li>
Evaluating and testing enterprise security controls deployed in multiple IT infrastructure environments;</li><li>
Automating incident response tasks and other processes using scripting languages like PowerShell, Python, and Bash;</li></ul>
What you will bring to the team:
We&rsquo;re looking for someone with a growth mindset and a passion for consultative selling. You might be a great fit if you:<ul><li>
Are highly analytical, organized, and proactive in solving challenges</li><li>
Communicate clearly and confidently, translating technical concepts for diverse audiences</li><li>
Thrive in dynamic environments and adapt quickly to changing client needs</li><li>
Build strong relationships and influence decision-makers at all levels</li><li>
Demonstrate a commitment to continuous learning.</li></ul>
Skills and experience you have:
You don&rsquo;t need to check every box. We will consider a combination of education and experience, including:
The position requires a proactive individual who independently seeks and consumes cyber security knowledge to improve the security posture of the program. The ideal candidate must think calmly yet quickly during stressful cyber security incidents, effectively communicating with peers and management and possess the ability to evaluate suggestions, assess risks, and implement innovative solutions while ensuring compliance with standards and regulations.
The position requires a proactive individual who independently seeks and consumes cyber security knowledge to improve the security posture of the program. The ideal candidate must think calmly yet quickly during stressful cyber security incidents, effectively communicating with peers and management and possess the ability to evaluate suggestions, assess risks, and implement innovative solutions while ensuring compliance with standards and regulations.<ul><li>
BS in Computer Science, Engineering or a closely related field and 5 years of related experience in Cyber Security Incident Response</li><li>
Ability to secure operating systems including Windows and Linux;</li><li>
Ability to produce detailed incident timelines and investigation reports;</li><li>
Practical experience in digital forensics as part of incident response efforts;</li><li>
Requires excellent verbal, written communication and ability to interact professionally within a corporate environment;</li><li>
Ability to manage multiple assignments and track through to completion;</li></ul>
Pay Transparency
At XiFin, we believe in pay transparency and fairness. The expected annual salary for this role is $139,485, based on your experience, skills, and geographic location.
Depending on your qualifications, final compensation will be determined during the selection process and may vary accordingly.
Accessibility &amp; Accommodations
We&rsquo;re committed to providing an inclusive and accessible experience for all applicants. If you need a reasonable accommodation during the application process, please contact us at 858-436-2901.
Equal Opportunity Employer
XiFin is proud to be an equal opportunity employer. We value diverse voices and do not discriminate on the basis of race, color, religion, national origin, gender, gender identity, sexual orientation, disability, age, veteran status or any other basis protected by law.
Ready to apply? 
We&rsquo;d love to hear from you&mdash;even if you&rsquo;re not sure you meet every qualification. If you're excited about the role and believe you can contribute to our team, please apply. Let's build something meaningful together.</div>

Cyber Security Analyst

Search 4721+ Cyber defense analyst jobs near you this November. New roles added regularly across leading industries. Apply today.