Cyber Analyst - Mid

SUMMARY

The Cyber Analyst – Mid serves as a Vulnerability Assessment Analyst responsible for providing cybersecurity services that enforce and support Department of Defense (DoD) cybersecurity directives, policies, and procedures. This role ensures the security, confidentiality, integrity, and availability of DCAA systems and data through proactive vulnerability management, continuous monitoring, compliance enforcement, and incident response. The analyst plays a key role in reducing cyber risk, maintaining system resilience, and supporting continuous cybersecurity operations across the enterprise.

KEY DUTIES AND RESPONSIBILITIES:

Cloud Identity & Endpoint Security (Entra & Intune)

• Identity & Access Management (IAM): Architect and enforce zero-trust security postures using Microsoft Entra ID (formerly Azure AD). Manage Conditional Access policies, Multi-Factor Authentication (MFA), Identity Protection, and Privileged Identity Management (PIM).
• Endpoint Management: Administer the organization’s security posture via Microsoft Intune. Ensure all endpoints meet federal compliance standards.
• Continuous Maintenance: Oversee continuous server and endpoint patching, monitoring end-of-life systems, and tracking priority vulnerability action items.

Threat Detection & Log Analysis (Defender & Azure Log Analytics)

• XDR Administration: Utilize Microsoft Defender (Endpoint, Cloud, Identity, Office 365) for continuous threat monitoring and automated response. Manage alerts, investigate complex incidents, and tune defense configurations to mitigate false positives.
• Advanced Telemetry & Analytics: Leverage Azure Log Analytics to ingest and analyze security telemetry. Write advanced Kusto Query Language (KQL) queries to develop custom detection rules, automated playbooks, alerts, and executive-level threat dashboards.
• Proactive Threat Hunting: Search existing cloud infrastructure for signs of commodity malware, APTs, and malicious events that evade baseline security controls.

Incident Response & Engineering Operations

• Vulnerability & Incident Management: Support incident response efforts by identifying, diagnosing, and mitigating vulnerabilities related to emerging threats and zero-day exploits.
• System Diagnostics: Utilize software and hardware diagnostic tools to troubleshoot complex application and server issues, responding directly to federal customer service requests.
• Strategic Collaboration: Interface with the PMO and vendor support service groups to support Cyber Task Order efforts, ensuring proper escalation during outages or degraded system performance.
• Lifecycle Engineering: Design, build, test, and implement new secure systems and architectural improvements.
• Advisory & Communication: Engage in weekly engineering meetings to advise on mitigation, compliance, and assessment initiatives. Work independently and collaboratively, applying critical thinking and effective communication (oral and written) with federal customers and team members.

EDUCATION AND/OR EXPERIENCE:

• Bachelor’s (BS/BA) degree in Computer Science, Management Information Systems, Cybersecurity, Cloud Computing, or a related IT discipline.
• Allowable Substitution: An additional four (4) years of direct Cybersecurity/Cloud Computing/IT experience may be substituted for a bachelor’s degree.
• Demonstrated experience working with complex system implementations, operations, and maintaining detailed organizational process documentation.
• Ability to pass and maintain a high-level federal background investigation.
• Active CompTIA Security+ certification (required prior to start).

REQUIRED POST-EMPLOYMENT CERTIFICATIONS: (Note: If not currently possessed, the selected candidate must obtain the following within a designated timeframe post-employment)

• Microsoft Certified: Security Operations Analyst Associate (SC-200)
• Microsoft Certified: Cybersecurity Architect Expert (SC-100)
• Microsoft Certified: Cloud and AI Security Engineer Associate (SC-500)