Cyber Threat Intelligence Analyst - Washington, United States - Bering Straits Native Corporation (BSNC)

Description

Overview:

Visit our website at to apply

SUMMARY

BGS, a subsidiary of Bering Straits Native Corporation is currently seeking a qualified Cyber Threat Intelligence Analyst for a project in Washington D.C. The ideal candidate for this job will serve as a Cyber Threat Intelligence Analyst within the federal clients Cyber Division Cyber Integration Center. A highly motivated individual with strong technical, communication, and organizational skills will succeed on this program. This position is REMOTE.

ESSENTIAL DUTIES & RESPONSIBILITIES

The Essential Duties and Responsibilities are intended to present a descriptive list of the range of duties performed for this position and are not intended to reflect all duties performed within the job. Other duties may be assigned.

• Perform research using open-source and classified Cyber Threat Intelligence sources to identify and track Advanced Persistent Threats (APT), malware packages, and exploitable vulnerabilities. Identify and prepare profiles on any threats or topics that are applicable to the client.
• Provide the in-house Threat Hunting & Forensics (THF) Team with Indicators of Compromise (IOCs), Tactics, Techniques, and Procedures (TTPs), and other background information about threats relevant to the client.
• Assist the THF Team and the clients Security Operations Center (SOC) in the development of new and specific detection techniques for the profiled threats.
• Notify appropriate stakeholders of items of concern, such as unpatched vulnerabilities, attack surface exposures, and other threats discovered in the research process.
• Ongoing maintenance of the Cyber Threat Intelligence SOP to revise processes and reporting methods.
• Maintain consistent awareness to industry trends and topics, including available cyber security intelligence tools, blog posts, and news postings. This will also include monitoring of various social media platforms for any emerging threats, as well as contra-reputational information posted about the client.
• Prepare professional written deliverables and oral presentations for the clients senior leadership on profiles, threats, metrics and trends as required.
• Adapt to dynamically changing priorities, based on severity of threats, leadership requests, or sources of information.
• Cultivate professional relationships with other organizations, internal departments, and stakeholders, exchanging information and findings as appropriate.
• Process controlled information reports from CISA as required.
• Develop a proactive method of monitoring Darknet sources for information which may indicate a threat or item of concern for the client.
• Monitor and maintain a cloud based MISP installation, indicator ingestion, and evaluate new threat feeds for MISP.
• Evaluate any new threat intelligence tools, retail or open source, that may be of benefit to the client.
• Track work progress and metrics using Azure DevOps.
• Cross-train with related teams, including THF Team, SOC, and Penetration Testing Team

QUALIFICATIONS - EXPERIENCE, EDUCATION AND CERTIFICATION

To perform this job successfully, an individual must be able to satisfactorily perform each essential duty. The requirements listed below are representative of the knowledge, skill and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

Required (Minimum Necessary) Qualifications (applies to both this section and KSAOs)

• Bachelor's Degree in related field. Related fields include intelligence analysis, national security, international relations, or similar.
• Moderate understanding of basic computer and networking technologies
• Windows operating systems
• Networking technologies (routing, switching, VLANs, subnets, firewalls)
• Common networking protocols SSH, SMB, SMTP, FTP/SFTP, HTTP/HTTPS, DNS, etc.
• Common enterprise technologies Active Directory, Group Policy, and the Microsoft Azure suite of services.
• Understanding of current system logging technology and retrieving information from a plethora of platforms.
• Ability to work with or learn Microsoft Power BI.
• Ability to obtain and maintain Public Trust Security Clearance.
• Applicants selected will be subject to a government security investigation and must meet eligibility requirements for access to classified information. Accordingly, U.S. Citizenship is required.

Knowledge, Skills, Abilities, and Other Characteristics

• Grasp of CTI Concepts:
• Intelligence methods, frameworks, and standards
• Practical knowledge of researching, collection skills, and analytical methods
• Tracking threat actors and researching their TTPs
• Open and closed-source intelligence
• CTI-focused products, platforms, and technologies
• Using commercial and open-source platforms, such as including Shodan, Censys, or similar
• Excellent analytical and problem-solving skills. The preferred candidate should have the ability to work independently, but also to work as part of a team.
• The ideal candidate will have an above the minimum attitude.
• Outstanding communication skills, both written and verbal, are a must. Ability to communicate with senior management and federal client staff both technical and non-technical in a clear and concise manner using proper spelling, punctuation, and grammar.
• Strong expert proficiency in Microsoft Office 365 products and features of each.
• Familiarity with the Microsoft Azure suite of products including Microsoft Sentinel and Microsoft 365 Defender.
• The ability to rapidly shift priorities efficiently is a necessary skill for this position.
• Ability to speak publicly within the organization at meetings with up to 100 participants.
• Willingness to take on and adapt to new, open-ended tasks for which there is no current standard operating procedure.
• Ability to research independently and self-teach.

Preferred

• Interest in security/hacking culture. Ability to think like an attacker
• Any CTI certification, especially:
• SANS: GIAC Cyber Threat Intelligence (GCTI)
• CREST Practitioner Threat Intelligence Analyst (CPTIA) or higher
• Center for TI: Certified Threat Intelligence Specialist I (CTIS-I) or higher
• Any Microsoft Azure certification, especially:
• Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900)
• Microsoft Certified: Security Operations Analyst Associate (SC-200)
• Microsoft Certified: Azure Fundamentals (AZ-900)
• Microsoft Certified: Azure Security Engineer Associate (AZ-500)
• Expertise in Microsoft Power BI
• Knowledge of technologies, policies, and concepts such as:
• Microsoft Sentinel SIEM
• Kusto Query Language (KQL)
• Malware Information Sharing Platform (MISP) administration
• Database technologies (MySQL) for MISP maintenance
• Linux and Docker for MISP maintenance
• IBM Mainframe
• Mobile device technologies (iOS, Android)
• Scripting experience (PowerShell, Python, etc.)
• Firewall and endpoint protection administration
• Azure DevOps
• NIST and CISA requirements and auditing
• Vulnerability management

NECESSARY PHYSICAL REQUIREMENTS

The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Employees must maintain a constant state of mental alertness at all times. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

Essential and marginal functions may require maintaining physical condition necessary for bending, stooping, sitting, walking, or standing for prolonged periods of time; most of time is spent sitting in a comfortable position with frequent opportunity to move about.

COVID VACCINATION REQUIREMENTS

• This position is not currently subject to federal or company requirements regarding COVID-19 vaccination or regular testing; but this is subject to change at any time. Employees are expected to comply with all current and future federal and company requirements.

DOT COVERED/SAFETY-SENSITIVE ROLE REQUIREMENTS

• This position is not subject to federal requirements regarding Department of Transportation safety-sensitive functions.

WORK ENVIRONMENT

Job is performed in an office setting with exposure to computer screens and requires extensive use of a computer, keyboard, mouse, and multi-line telephone system. The work described herein is primarily a modern office setting. Occasional travel may be required.

SUPERVISORY RESPONSIBILITIES

• No supervisory responsibilities.

ADDITIONAL QUALIFYING FACTORS

As a condition of employment, you will be required to pass a pre-employment drug screening and have acceptable background check results. If applicable to the contract, you must also obtain the appropriate clearance levels required and be able to obtain access to military installations.

Shareholder Preference. BSNC gives hiring, promotion, training and retention preference to BSNC shareholders, shareholder descendants and shareholder spouses who meet the minimum qualifications for the job.

Bering Straits Native Corporation is an equal opportunity employer. All applicants will receive consideration for employment, without regard to race, color, religion, creed, national origin, gender, or gender-identity, age, marital status, sexual orientation, veteran status, disability, pregnancy or parental status, or any other basis prohibited by law.

We participate in the E-Verify Employment Verification Program. We are a drug free workplace.