Cyber Threat Intelligence Engineer

CACI International•St. Louis, MO

About The Position

TCS is hiring a new member to our Cyber Security Operations 3 -Threat Services team. This role will proactively search for indicators of compromise on NGA systems through planned Hunt missions. • Assign the Cybersecurity Operations Manager to direct and oversee all Contractor support for this subservice and serve as the primary Contractor representative to the government CSOC Director for coordination, collaboration, planning, communication, status updates, and necessary approvals of all actions in support of this sub-service • Operate as an end user, the relevant assets contained within the Government Furnished Information - Software Tools list in accordance with vendor instructions, industry best practice, and government directives, policies, procedures, etc. • Conduct emerging threat and intelligence fusion analysis • Collect and analyze commercial and government cyber intelligence reports • Analyzes intelligence reports to provide actionable cyber intelligence • Develops and provides to the Government and other Contract Services regular and ad hoc reports, briefs, documents, diagrams, and other products as required to ensure stakeholders are aware of and understand cybersecurity threats and the risk posed to NGA by the threat;

Requirements

Current TS/SCI and must obtain a CI Poly within 6 months of Start
Bachelor’s Degree in a Technical Field
5+ years’ experience working in related Cyber area.
Current Security+ CERT to start work on program; however, will need to obtain IAT Level II and CSSP Analyst Certification within six (6) months of your start date. The cost of the certification(s) will be covered by CACI. In the event that you do not obtain the required certification(s) within the 6-month timeframe, you will be asked to depart the program.

Responsibilities

Identifies and assesses the relevance and effectiveness of signatures and indicators of compromise based on intelligence
Develops, reviews, and when properly authorized by the Government, disseminates NGA CSOC developed Cyber Intelligence products to internal to NGA and external DoD and IC partners, to include but not limited to threat intelligence reports, significant cyber activity reports, incident investigation reports, and other products as directed by the Government
Analyzes patterns of behavior to identify and determine adversary intent and provides this analysis to the Government in a document, briefing and/or other products as required
Develops comprehensive threat models of adversary activity and provides this analysis to the Government in a formal report, briefing, or other product as required
Maps NGA cyber terrain to identify likely avenues of attack in coordination with Cyber Readiness Services and Cyber Technology Services; provides this analysis and recommendations to mitigate or remediate the avenue of attack to the Government
Coordinates with NGA entities, to include but not limited to SI Cyber Counterintelligence, Insider Threat, and Blue Team to perform adversary profiling and threat modeling
Coordinates with SIII Technical Investigations to enhance forensics investigations and analysis
Coordinates with Source and Analysis to perform intelligence fusion and analysis
Coordinates with Vulnerability Management and Risk Management as required to assess risk to NGA assets.
Assesses, monitors for, and takes action on indicators of compromise identified in community intelligence reports as required; this includes but is not limited to determining relevance and directing the implementation of indicator blocks, the creation of new detection alerts, referring the information to Hunt, or to Tier 2 for analysis, and coordinating with Advanced Cybersecurity Analytics on the development of new signatures
Documents all work in the authorized ticketing system with a level of detail sufficient to enable the Government and other services to reconstruct the analysts analysis process