Network and Threat Support Specialist (Senior)

WOOD is currently hiring Network and Threat Support Technicians to support our customer in Ft. Meade, MD 

What we offer: 

• Creative work environment that promotes professional growth
• Company paid insurance through Carefirst: Medical, Dental, Vision
• Company matching 401K
• 4 weeks of PTO and 10 paid holidays
• Professional Improvment and Educational reimbursement- up to $5000 annually
• Continued training through WOOD University
• WOOD is a certified PMI trainer
• Competitive salary and much much more!

• Designing, demonstrating, developing, implementing, and updating exploitation or protection methods and recommending mitigation strategies and techniques.
• Evaluating multiple operating systems, network configurations, network architectures and topologies for potential technical and/or operational vulnerabilities. Efforts also include:
  • Analyzing network transports and application layer packets and identifying packet details
  • Identifying anomalies at the packet level and developing signatures to support various collection platforms
  • Demonstrating proficiency with common network protocols and analysis tools, specifically Wireshark (Ethereal)
• Determining the threat to U.S. networks of interest posed by adversarial systems, activities or operations.
• Performing each phase of cyber activity tracking; conducting network reconnaissance to detect the presence of unexpected behavior, identifying anomalous activity, categorizing and tagging intrusive activity. Efforts also include:
• Performing network intrusion incident response and network attack characterization and reconstruction
• Identifying signatures, attack scenarios, attacker profiles, and other relevant information to enhance Customer's knowledge of the adversary and the techniques employed
• Performing in-depth technical analysis with the goal of determining what the intruder did or attempted to do, where they came from, how they got in, their motivation, and anything else that can be learned from analyzing the intrusion data to include:
  • Developing techniques for the identification and analysis of malicious activity
  • Understanding the development of SNORT signatures or similar intrusion detection syntax
  • Determining the extent of malware's capabilities, how to detect it and to assess its impact on affected systems
• Conducting real world, near real time, monitoring, analysis and reporting.
• Utilizing tools (in-house, freeware, commercial) and analytical techniques to determine the levels of severity and potential mission impact of anomalous behavior.
• Writing scripts/tools to develop an analysis capability to include:
  • Applying basic analytic methods such as computer programming, (JAVA, Perl, C, etc.) and debugging programs
  • Developing technical techniques and processes
• Performing in-depth technical analysis of collected network traffic.
• Reviewing log files, Access Control List (ACL), network Intrusion Detection System (IDS) records and host IDS records for evidence of pre-intrusion activity.
• Responding to Information Needs (IN) requests, coordinating with other organizations as appropriate.
• Developing end-product report drafts and entering them into report production systems.
• Documenting analytical results, processes, and methodologies, and generating technical ideas to include:
  • Compiling situational reports for each cyber tracking phase to document status
  • Technically documenting and reporting on forensic findings to include attack mechanisms, forensic procedures and defensive strategies
• Characterizing methods with respect to resources and capabilities required or risks of detection and attribution.
• Discovering methods of protecting specific networks, computer systems or specific hardware or software.
• Independently conducting comprehensive analysis on all types of forensics microcomputer and computer media. Efforts also include:
  • Forensically analyzing magnetic and optical media using forensic software applications
  • Conducting forensic examination of computer-related equipment, including network devices
  • Analyzing and interpreting technical data
• Participating in team building research efforts, and sharing analytical techniques and research methodologies. Efforts also include:
  • Scheduling meetings, analytic exchanges, organizing data, and providing overall support to branch and division-level managers
• Reviewing and evaluating existing modeling and simulation capabilities to determine appropriate levels of anomalous activities needed to stimulate response actions.
• Characterizing operational vulnerabilities, and forensic evidence of realistic incidencts and intrusion methods for use during exercise and training activities.
• Building requirements for modeling and simulation capabilities to include operating systems, network configurations, network architectures, and topologies.
• Operating, providing instruction, and maintaining simulation/models with respect to cyber operations.
• Providing a variety of support to projects, including planning, monitoring, testing, and assessing.
• Assisting in the development and implementation of policies, guidelines, and procedures to ensure effective support of projects.
• Effectively participating in cross-functional meetings, clearly articulate modeling and simulation capabilities and translate requirements.
• Attending and facilitating exercise planning and technical conferences as directed by the government.

*All Candidates must have a TS/SCI clearance with a Polygraph

• Shall have a minimum of eight (8) continuous years of work experience in network and vulnerability analysis, or a combination of a minimum of five (5) continuous years of work experience in network and vulnerability analysis and a Bachelor’s degree in an applicable (math, science, computers, engineering) field.
• Work experience shall include five (5) years of IC experience in network and vulnerability analysis.
• Shall have demonstrated expertise related to the use of relevant Computer Network Operations (CNO) and SIGINT tools and databases used for the customer mission.
• Shall also demonstrate analytic ability to discover unknown, suspicious or exploitation activity, be able to provide briefings of intrusion set activity to partner organizations/agencies, and be knowledgeable about all forms of reporting and experienced with creating each product type, and thus be able to organize training for other team members on analysis, tools, or reporting.
• Shall have demonstrated the analytic expertise to perform technical analysis for exploitation of an identified activity that is of an unknown or suspicious origin, competence with relevant analyst tools and databases used by the customer organization, and communications skills that include the ability to provide formal documentation of analysis and/or research results.
• Shall be considered a SME in one or more fields appropriate to Intelligence Analysis or Computer Networking technologies, and be able to serve as a SME for working groups and meetings with partner organizations/agencies.
• Shall have demonstrated expertise in analyzing intelligence information and technical data, analyzing exploitation opportunities, interpreting analytical results, writing and editing skills at a technical/professional level, and managing internal and external customer relations.
• Shall have demonstrated skills working through the SIGINT and/or other intelligence disciplines' production processes, to include tasking, researching, processing, reporting, and disseminating of collection, information, or final products.
• Shall demonstrate the ability to understand and interpret technical data through knowledge of technologies and network topologies.
• Shall have demonstrated expertise in documenting information and processes and gathering intelligence information of an identified threat activity through SIGINT and/or other intelligence disciplines, Internet, and other research means.
• Experience in the computer network operations analyzing vulnerabilities and mitigating threats, with an emphasis on forensics and defensive triage operations.
• Capability to administer computer networks and set up modeling and simulation enclaves.
• Intimate knowledge of the DoD intrusion detection and forensic capabilities.
• Experience with automated processing standards, life cycle management, and configuration management of disjointed/joined networks.
• Strong ability to visualize overall view of systems and conceptualize and document technical solutions to modeling and simulation problems.
• Excellent oral, written, interpersonal communication and presentation of skills across organizational boundaries and ability to work with a range of technical staff to develop joint solutions. 

Required Tools/Certifications: Wireshark/Ethereal, Nessus, Snort, tcpdump, tcp wrapper, IDS (various), ISS scanner, eEye digital vulnerability scanner, <forensics work at host, network, or software levels>, <penetration testing work>, <malware, spyware, botnet work>, GCFIH, CNDA, DoD Forensic examiner, DoD Media Collector, Security+,  Nmap, SSCP, Cisco CCNA ( and other Cisco related network certs),  Network+, Net Impact

Preferred Tools/Certifications: IDA Pro, MetaSploit, EnCase, Cain and Abel, John the Ripper, Ollydebug, HBSS, GSEC, GCIA, GPEN, GCFW, GCFA, CORE Impact, DoD certified basic digital media collector, Paraben

WOOD is an Equal Employment Opportunity Employer; all qualified applicants are encouraged to apply and will receive consideration for employment without regard to race, color, religion, sex, national origin, disability, or veteran status.