• Intrusion Detection Engineer, Sr.

    Location US-MD-Ft. Meade
    Posted Date 1 year ago(1 year ago)
    Job ID
    N-1259
    # Positions
    1
    Experience (Years)
    8
    Category
    Cyber Security
  • Overview

    WOOD is currently hiring a Sr. Network and Threat Support Specialist to join our team in Ft. Meade, MD. The ideal candidate will understand malware reverse-engineering, Have the ability to perform packet level analysis, Intrusion Detection, and Incident Handling, investigate and resolve highly complex operational matters, and have experience in using test tools and writing scripts (Perl, Python, Ruby, etc.).

     

    Responsibilities

     

    • Analyze, map, protect or discover vulnerabilities, intrusions and threats in computer network systems
    • Have a working knowledge of forensic media analysis, perform in-depth diagnostic analysis of computer and network intrusions, determine if modifications have been made to a suspect system(s) and the vector by which that modification occurred
    • Perform in-depth analysis of computer and network intrusion incident data and in-depth technical analysis of network traffic with the goal of detecting malicious activity; and/or Perform long-term and time sensitive, in-depth technical analysis of malicious code (malware), analyze the inner workings, and develop defensive countermeasures
    • Design, demonstrate, develop, implement, and update exploitation or protection methods and recommending mitigation strategies and techniques
    • Evaluating multiple operating systems, network configurations, network architectures and topologies for potential technical and/or operational vulnerabilities. Efforts also include:
      • Analyzing network transports and application layer packets and identifying packet details
      • Identifying anomalies at the packet level and developing signatures to support various collection platforms
      • Demonstrating proficiency with common network protocols and analysis tools, specifically Wireshark (Ethereal)
    • Performing in-depth technical analysis with the goal of determining what the intruder did or attempted to do, where they came from, how they got in, their motivation, and anything else that can be learned from analyzing the intrusion data to include:
      • Developing techniques for the identification and analysis of malicious activity
      • Understanding the development of SNORT signatures or similar intrusion detection syntax
      • Determining the extent of malware's capabilities, how to detect it and to assess its impact on affected systems
    • Utilizing tools (in-house, freeware, commercial) and analytical techniques to determine the levels of severity and potential mission impact of anomalous behavior.
    • Writing scripts/tools to develop an analysis capability to include:
      • Applying basic analytic methods such as computer programming, (JAVA, Perl, C, etc.) and debugging programs
      • Developing technical techniques and processes
    • Other duties as assigned

    Qualifications

    *All Candidates must have a TS/SCI clearance with a Polygraph

    • Shall have a minimum of eight (8) continuous years of work experience in network and vulnerability analysis, or a combination of a minimum of five (5) continuous years of work experience in network and vulnerability analysis and a Bachelor’s degree in an applicable (math, science, computers, engineering) field.
    • Work experience shall include five (5) years of IC experience in network and vulnerability analysis.
    • Shall have demonstrated expertise related to the use of relevant Computer Network Operations (CNO) and SIGINT tools and databases used for the customer mission.
    • Shall also demonstrate analytic ability to discover unknown, suspicious or exploitation activity, be able to provide briefings of intrusion set activity to partner organizations/agencies, and be knowledgeable about all forms of reporting and experienced with creating each product type, and thus be able to organize training for other team members on analysis, tools, or reporting.
    • Shall have demonstrated the analytic expertise to perform technical analysis for exploitation of an identified activity that is of an unknown or suspicious origin, competence with relevant analyst tools and databases used by the customer organization, and communications skills that include the ability to provide formal documentation of analysis and/or research results.
    • Shall be considered a SME in one or more fields appropriate to Intelligence Analysis or Computer Networking technologies, and be able to serve as a SME for working groups and meetings with partner organizations/agencies.
    • Shall have demonstrated expertise in analyzing intelligence information and technical data, analyzing exploitation opportunities, interpreting analytical results, writing and editing skills at a technical/professional level, and managing internal and external customer relations.
    • Shall have demonstrated skills working through the SIGINT and/or other intelligence disciplines' production processes, to include tasking, researching, processing, reporting, and disseminating of collection, information, or final products.
    • Shall demonstrate the ability to understand and interpret technical data through knowledge of technologies and network topologies.
    • Shall have demonstrated expertise in documenting information and processes and gathering intelligence information of an identified threat activity through SIGINT and/or other intelligence disciplines, Internet, and other research means.

     

    Required Tools/Certifications: Wireshark/Ethereal, Nessus, Snort, tcpdump, tcp wrapper, IDS (various), ISS scanner, eEye digital vulnerability scanner, <forensics work at host, network, or software levels>, <penetration testing work>, <malware, spyware, botnet work>, GCFIH, CNDA, DoD Forensic examiner, DoD Media Collector, Security +, Nmap, SSCP, Cisco CCNA ( and other Cisco related network certs), Network +, Net Impact

     

    Preferred Tools/Certifications: IDA Pro, MetaSploit, EnCase, Cain and Abel, John the Ripper, Ollydebug, HBSS, GSEC, GCIA, IAM, IEM, GPEN, GCFW, GCFA, CORE Impact, DoD certified basic digital media collector, Paraben

      

    Equal Opportunity Employer/Veterans/Disabled

    WOOD is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, or protected veteran status and will not be discriminated against on the basis of disability.

    Options

    Sorry the Share function is not working properly at this moment. Please refresh the page and try again later.
    Share on your newsfeed