• Create analytics with a SIEM to identify patterns, anomalies, and compromising indicators to alert Cyber Incident responders.
• Create dashboards in the SIEM platform to tip analysts to malicious activities directed against the DoD information systems.
• Create dashboards and report in the SIEM platform to assist network defenders in identifying issues and concerns.
• Perform daily review of analytic performance on the SIEM identifying correlation engine slowdowns.
• Evaluate intrusion detection sensor configurations for proper alert capability.
• Evaluate intrusion detection signature for appropriateness to DoD networks and implement rules as required.
• Contribute to the design, development and implementation of countermeasures, system integration, and tools specific to Cyber and Information Operations.
• Assist in the integration of additional security platforms to correlate new data with HIDS and NIDS alerts.
• Prepare and presents technical reports and briefings.
• Write reports on capabilities of the defensive cyber operations to increase customer situational awareness and improve the customer’s cyber security posture.
• Write and update SOP and TTPs as required by the local customer.

• Bachelor’s degree in a STEM field or Business Administration and a minimum of 3 years experience in Systems Engineering.
• Must be able to qualify for Technical Expert Status Accreditation (TESA) by having a bachelor's degree in a STEM or Business field plus 3 years of specialized experience OR an Associate’s degree plus 7 years of specialized experience.
• Experience in developing dashboards and creating and maintaining Elasticsearch rules.
• Experience with intrusion detection systems such as Snort, Suricata, and TippingPoint.
• Active DoD Approved 8140 Certification in:
  
  • DCWF 521 Intermediate (B.S. in IT or one of the following: GMON, GRID, CEH, Cloud+, CySA+, GSEC,Security+, PenTest+, SSCP).
  • 8140 Residential Certification: Any one of the following: GDAT, GDSA, Elastic Certified, ArcSight ESM Advanced Analyst Certified Expert, Microsoft Certified: Cybersecurity Architect Expert, Azure DevOps Engineer Expert, TCM Security PNPT.
• U.S. citizenship required.
• An Active DoD Top Secret security clearance with SCI eligibility.

• Experience with one or more scripting languages: PowerShell, Bash, Python.
• Experience working with Gitlab.
• Familiarity with ATT&CK Navigator and the MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) matrices.

Target Salary Range: $80,000 - $128,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual’s experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.

Benefits Statement: Peraton offers eligible employees a variety of benefits including medical, dental, vision, life, health savings account, short/long term disability, EAP, parental leave, 401(k), paid time off (PTO) for vacation, and company paid holidays. A full listing of available benefits can be viewed at https://www.careers.peraton.com/benefits.

Application Statements: The application period for the job is estimated to be 30 days from the job posting date. However, this timeline may be shortened or extended depending on business needs and the availability of qualified candidates. By applying to this job, you are expressing interest in the role and the Company. During the review of your application, you may be required to participate in an on-camera interview, as well as participate in a process to verify your identity.