CIRT Tier 2 Analyst / Active Secret
Peraton · Beltsville, MD, US
About this role
**Peraton — CIRT Tier 2 Analyst / Active Secret** **Location & Schedule** - **Beltsville, MD (On-site)** - **Mid Shift:** 22:00–06:00 EST - **Days:** Sun–Thu **What You’ll Do** - Detect, classify, process, track, and report **cybersecurity events and incidents** - Perform **advanced in-depth analysis** of coordinated **Tier 1** alert triage in a **24x7x365** environment - Analyze logs from multiple sources (e.g., **host logs, EDR, firewalls, IDS, servers**) to identify, contain, and remediate suspicious activity - Characterize and analyze **network traffic** to identify anomalous activity and potential threats - Protect against and prevent cybersecurity threats and vulnerabilities - Conduct **forensic analysis** of host artifacts, network traffic, and email content - Analyze malicious scripts/code; perform **malware analysis** and generate **IOCs** - Collaborate with **Department of State** teams to analyze and respond to events/incidents - Monitor/respond to the **CIRT SOAR platform**, hotline, and email inboxes - Create tickets and initiate workflows per technical SOPs - Coordinate and report incident information to **CISA** - Collaborate with other local/national/international CIRTs as directed - Submit **alert tuning** requests **Required Qualifications** - **Bachelor’s degree + 2 years** of experience (or **4 additional years** experience in lieu of degree) - Must possess (or be able to obtain) at least one certification before start date: - **CCNA-Security, CND, CySA+, GICSP, GSEC, Security+, CE, SSCP** - **Continued certification** required as a condition of employment - Demonstrated experience in the **Incident Response lifecycle** - Knowledge of **SOAR** ticketing/automated response systems (e.g., **ServiceNow, Splunk SOAR, Microsoft Sentinel**) - Demonstrated experience with **SIEM** platforms (e.g., **Splunk, Microsoft Sentinel, Elastic, QRadar**) - Demonstrated experience with **EDR** systems (e.g., **MDE, ElasticXDR, CarbonBlack, CrowdStrike**) - Knowledge of **cloud security monitoring** and incident response - Knowledge of integrating **IOCs** and **APT** actors - Ability to analyze cyber threat intelligence and understand adversary methodologies/techniques - Knowledge of **malware analysis** techniques - Knowledge of **MITRE ATT&CK** and **D3FEND** - **U.S. Citizenship required** - **Active Secret clearance required** to start **Preferred Qualifications** - Proficiency with **Splunk** (monitoring, alert creation, threat hunting) - Knowledge of **Microsoft Azure** access/identity management - Proficiency with **Microsoft Defender for Endpoint** and **Identity** - Experience with digital forensics tools (e.g., **Autopsy, MagnetForensics, Zimmerman Tools, KAPE, CyLR, Volatility**) - Experience with **ServiceNow SOAR** - Knowledge of **Python, PowerShell, BASH** - Experience with cloud security monitoring/incident response - Ability to perform **static/dynamic malware analysis** and reverse engineering - Experience integrating CTI and **IOC-based hunting** - Technical certifications (examples listed): **Security+, CySA+, Cloud+, Try Hack Me SAL1, Hack the Box CDSA, CyberDefenders, CCD, Azure SC-900, CCSP, GCIH, CCSK, GSEC, CHFI, GCLD, GCIA** - Advanced technical certifications (examples listed): **SecurityX/CASP+, PRMP, GREM, GEIR, GNFA, GCFA** **Target Salary Range** - **$80,000 – $128,000** (typical range) - May include **overtime, shift differential, and discretionary bonus** depending on role **Benefits (Summary)
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.