SAIC Security Operations Center (SOC) Analyst in BROOMFIELD, Colorado
SAIC has an opportunity for a Security Operations Center (SOC) Analyst to support the US Army Corps of Engineers Revolutionary IT Services (USACE RITS) program.
The USACE RITS contract will provide modern and secure enterprise-wide IT support services to approximately 37,000 USACE customers located throughout the CONUS and OCONUS. Services will support the mission needs of USACE’s Headquarters (HQs) located in Washington, D.C., nine Divisions and 43 Districts, to include over 1,500 field and area project offices and two data centers that are currently located in Vicksburg, Mississippi, and Hillsboro, Oregon.
The ideal candidate will be the point of contact for monitoring agency networking environments, including cloud, DMZs and secure LANs, as required by the USACE OCIO/G-6. The service shall also support connectivity to extranets and the internet.
Major duties with monitoring include:
Providing analysis and monitoring for all systems and environments to ensure the availability, integrity, and confidentiality of the data processed, stored, and transmitted via a centralized support monitoring service. Analysis and monitoring shall be automated to the maximum extent possible.
Providing Intrusion Detection System/Intrusion Prevention System (IDS/IPS) support:
Implementing, administering, and maintaining threat sensors based on current threat directives and recommendations.
Developing, testing, and distributing threat sensor baseline signatures.
Developing IDS/IPS test plans, operational procedures, and maintenance plans.
Providing host-based intrusion detection monitoring and prevention on all devices, including those supporting Host-Based Security Systems (HBSSs).
Providing data feeds from all intrusion detection and prevention modules for incorporation into the Enterprise Security Incident Management System, for CorpsNet, cloud, DMZ, and SIPR in accordance with classification guidance.
Providing continuous monitoring of malware protection and detection mechanisms.
Providing administrator access to the designated Government POCs as required.
Providing active monitoring of the operational status, health, and performance of the monitoring tools and devices.
Actively monitoring vendor feeds, Army feeds, tippers, OPORDS, sensor grids, and intelligence feeds for new signature information.
Analyzing the information provided and providing recommendations for inclusion into the CorpsNet, and SIPRNet environments, while maintaining the classification of information.
Providing performance measurements, logs, and information feeds from the security monitoring systems (e.g., HBSS and IPS).
Maintaining access to current network architecture diagrams per DISA standards showing placement of sensors (e.g., IDS/IPS, Routers, Netflow/PCAP systems, firewall, etc.).
Reporting on access to assets, including, but not limited to, network and host-based sensors for CorpsNet, CorpsNet extended network (JRSS and cloud), and SIPRNet.
Integrating and correlating data from USACE systems, servers, services, SIEM, and end points to measure, monitor, remediate, and remove threats to the environment in accordance with USACE OCIO/G-6 directives.
Major incident response duties include:
Responding to alerts and violations identified, in accordance with cyber policy and incident response plans, as part of the SIEM.
Identifying incident threat level and nature based on the received alert or violation.
Identifying root cause, source, and methodology used to properly categorize the incident.
Providing AR 380-53 Network Damage Assessment, if necessary.
Gathering host logs from compromised system(s).
Taking corrective action to contain the incident, prevent further spread, and protect systems.
Providing forensically sound evidence collection and capabilities.
Eradicating the malicious event from infected hosts/network as directed by USACE OCIO/G-6.
Providing cyber clean-up as required, including the restoration of damaged data.
Recommending mitigating actions to prevent future infections or reinfection.
Configuring and fine-tuning detection/prevention capabilities.
Providing cyber After Action Reports (AARs), including lessons learned and final network damage assessment as identified by USACE OCIO/G-6.
Providing analysis, correlation, and trending of anomalous events and incidents.
Supporting incident response team deployment to USACE OCIO/G-6 locations.
Coordinating and sharing data with other Federal agencies and DoD commands as directed by USACE OCIO/G-6.
Providing analysis and reverse engineering of cyber threats.
Implementing mitigation measures in response to general or specific threats on the respective networks in accordance with USACE OCIO/G-6 directives.
Other general duties include: Designs, tests, and implements secure operating systems, networks, security monitoring, tuning and management of IT security systems and applications, incident response, digital forensics, loss prevention, and eDiscovery actions. Conducts risk and vulnerability assessment at the network, system and application level. Conducts threat modeling exercises. Develops and implements security controls and formulates operational risk mitigations along with assisting in security awareness programs. Involved in a wide range of security issues including architectures, firewalls, electronic data traffic, and network access. Researches, evaluates and recommends new security tools, techniques, and technologies and introduces them to the enterprise in alignment with IT security strategy. Utilizes COTS/GOTS and custom tools and processes/procedures in order to scan, identify, contain, mitigate and remediate vulnerabilities, and intrusions. Assists in the implementation of the required government policy (i.e., NISPOM, DCID 6/3), and makes recommendations on process tailoring. Performs analyses to validate established security requirements and to recommend additional security requirements and safeguards. Supports the formal Security Test and Evaluation (STE) required by each government accrediting authority through pre-test preparations, participation in the tests, analysis of the results, and preparation of required reports. Periodically conducts a review of each system's audits and monitors corrective actions until all actions are closed. May support cyber metrics development, maintenance and reporting. May provide briefings to senior staff. Utilizes COTS/GOTS and custom tools and processes/procedures in order to scan, identify, contain, mitigate and remediate vulnerabilities, and intrusions. Assists in the implementation of the required government policy (i.e., NISPOM, DCID 6/3), and makes recommendations on process tailoring. Performs analyses to validate established security requirements and to recommend additional security requirements and safeguards. Supports the formal Security Test and Evaluation (STE) required by each government accrediting authority through pre-test preparations, participation in the tests, analysis of the results, and preparation of required reports. Periodically conducts a review of each system's audits and monitors corrective actions until all actions are closed. May support cyber metrics development, maintenance and reporting. May provide briefings to senior staff.
EDUCATION AND EXPERIENCE: Bachelors and two (2) years or more experience; additional four (4) years experience in lieu of degree
CLEARANCE REQUIREMENT: Must have a Secret clearance or be able to obtain a Secret
Target salary range: $85,001 - $95,000. The estimate displayed represents the typical salary range for this position based on experience and other factors.
SAIC is a premier technology integrator, solving our nation’s most complex modernization and systems engineering challenges across the defense, space, federal civilian, and intelligence markets. Our robust portfolio of offerings includes high-end solutions in systems engineering and integration; enterprise IT, including cloud services; cyber; software; advanced analytics and simulation; and training. We are a team of 23,000 strong driven by mission, united purpose, and inspired by opportunity. Headquartered in Reston, Virginia, SAIC has annual revenues of approximately $6.5 billion. For more information, visit saic.com. For information on the benefits SAIC offers, see Working at SAIC. EOE AA M/F/Vet/Disability