Forensics Assistant Jobs in Kansas (NOW HIRING)

Published: May 27, 2025 - The Cyber Security Analyst performs cyber security risk assessments and collaborates with the Cyber Security Operations Center to monitor, analyze, and investigate threats affecting the organization’s security posture. This position facilitates the implementation of security policies and awareness programs while providing detailed impact reports to management regarding information and system security incidents. This role participates in incident response activities and conducts research on threat actors and mitigation strategies to enhance overall cyber defense measures.

• Security Monitoring: Conduct security monitoring, threat hunting, security and data/log analysis, and forensic analysis to detect security incidents, and mount an incident response, utilizing commercial tools to find TTPs.
• IPS/IDS Tuning: Perform IPS/IDS and proxy tuning to increase the accuracy and performance of security appliances.
• Tech Research: Investigate and utilize new technologies and processes to enhance security capabilities and implement improvements.
• Procedure Development: Develop and maintain procedures to efficiently deliver Systems Security testing services.
• Issue Resolution: Create new ways to solve existing production security issues.
• Security Collaboration: Collaborate with colleagues on authentication, authorization, and encryption solutions.
• Policy Management: Collaborate on the definition, implementation, and maintenance of corporate security policies.
• Security Assessment: Proactively conduct hands‑on security assessments on systems and infrastructure equipment, identify security vulnerabilities/weaknesses, evaluate countermeasures, and recommend best security practices to mitigate the vulnerabilities.
• Vulnerability Review: Review results and recommend effective remediation of vulnerability scans, penetration tests, and compliance reports.
• Project Security: Participate and recommend security controls for IT and Systems related projects.
• Security Advocacy: Be a champion of effective security best practices and promote acceptance, adoption, and socialization.
• Incident Management: Participate in the information security incident management process.
• Report Development: Develop and maintain regular information security reports for managers and the team.
• Awareness Program: Assist with the development and promotion of a meaningful Systems Security Awareness Program.
• Security Updates: Stay informed about the latest developments in the information security field, including new products and services.

• Alert Investigation: Investigation of IT security alerts and incidents.
• Security Operations: Operational IT security, including the monitoring and maintenance of security tools, such as Security Incident & Event Management (SIEM), anti‑virus and vulnerability management platforms.
• Risk Assessment: Assist with IT security gap and risks assessments including PCI DSS, ISO 27001 and Cyber Security Essentials.
• Vulnerability Identification: Identification and risk assessment of newly identified vulnerabilities.
• Best Practice: Ensure that Information Security best practice is considered throughout and that any issues or concerns are escalated in line with Group procedures.
• Change Review: Reviewing changes to determine the IT security impact.
• Audit Support: Support internal and external audits.
• Documentation Reporting: Production of relevant documentation and reporting.
• Issue Escalation: Timely escalation of issues to Cyber Team Leader and Group Head of Technology.

• Certification Management: Plan, execute, and implement Certification and Accreditation (C&A) activities for Aviation Mission Planning System (AMPS) using the Risk Management Framework (RMF).
• POA&M Management: Manage and update POA&M in eMASS for multiple accredited operating systems.
• Deficiency Assessment: Assess system deficiencies and severities and recommend corrective actions to address identified vulnerabilities.
• Port Registration: Register Ports and protocols in the Ports and Protocols System Management (PPSM).
• Vulnerability Analysis: Perform, evaluate, and analyze impacts of vulnerability scans on a monthly basis utilizing Assured Compliance Assessment Solution (ACAS), Security Content Automation Protocol (SCAP) and manual checks from the DISA Security Technical Implementation Guides (STIGs) for multiple baselines.
• IA Representation: Serve as Information Assurance Representative to the AMPS Defect Review Board.
• Support Services: Provide information assurance support to AMPS System Service Representatives and external organizations where AMPS resides.
• FISMA Reviews: Conduct annual Federal Information Security Management Act (FISMA) Information Assurance Security Reviews of the AMPS builds.
• Configuration Guidance: Must be able to employ configuration guidance based on DISA Security Technical Implementation Guides (STIG).
• Assessment Support: Provide support for the attainment and sustainment of Assess only activities for independent applications.

• System Auditing: Audit information systems according to NIST SP 800‑37 and 800‑53, 800‑171, NISPOM and DFARs frameworks.
• Risk Analysis: Perform risk analysis and reporting on DFARs, NIST RMF, and NISPOM compliance.
• Exception Analysis: Perform complex analysis of the risk of security exceptions through the data security plan process.
• Mitigation Development: Recommend and develop mitigations to facilitate continued research despite exceptions from traditional security controls.
• Policy Development: Develop and enforce an information security policy.
• Security Outreach: Conduct staff security outreach and engagement.
• Risk Assessment: Assess the security risks of cutting‑edge technology.
• Vulnerability Support: Support vulnerability management operations through documentation and reporting of findings to lab leadership.
• Incident Response: Support incident response and remediation efforts.
• Compliance Assessment: Perform risk assessments in Cyber Security Essentials, PCI DSS & ISO27001.
• Threat Monitoring: Monitor the threats and investigate breaches.
• Strategic Leadership: Play a lead role in the strategic implementation and the design, development, implementation, and monitoring of security policy and controls for the appropriate protection of company assets.
• Project Management: Manage projects with multiple stakeholders and engage with key people at all levels within the organization.

• Team Participation: Participate in a larger security team and focus on installing, configuring, investigating alerts, anomalies, errors, intrusions, malware, etc. to identify threats, sources, determine remediation, and recommend security improvements or actions.
• Vulnerability Management: Configure and manage vulnerability scanning and patch management as part of proactive risk prevention.
• Analytical Follow‑up: Follow precise analytical paths (playbooks) to determine the nature and extent of problems being reported by tools, e‑mails, etc.
• Reporting Compliance: Follow strict guidance on reporting requirements.
• Management Reporting: Keep management informed with precise, unvarnished information about security posture and events – no surprises.
• Workflow Promotion: Promote standards‑based workflow.
• Information Sharing: Engage with internal and external parties to get and share information to improve processes and security posture.
• Threat Analysis: Lead analysis, investigation of anomalies, and threats.
• Cross‑teamwork: Work across business lines, especially with IT, on the integration of products/services and DevOps and the cloud environment.
• Report Creation: Create management‑friendly reporting from tools.
• User Support: Work with end‑users to investigate threats.
• Tool Integration: Create interfaces with existing tools to extract logs.
• Tool Configuration: Configure tools to meet ongoing requirements for monitoring.

• Access Monitoring: Monitor security access, security events and respond to alerts.
• Incident Support: Support security incidents through identification, containment, eradication and recovery.
• Firewall Management: Ongoing monitoring, management and configuration of firewall and security systems.
• Report Creation: Creation and modification of reports, dashboards and alerts.
• Configuration Support: Working with internal customers and managed service providers to address security configuration issues.
• Threat Hunting: Completed threat hunting engagements.
• Security Guidance: Provide security advice and guidance to other teams within the business.
• Workflow Automation: Development of automated workflows to minimise repetitive tasks and improve efficiency.
• Ticket Management: Ticket management for security incidents, requests and changes.
• Alert Investigation: Investigate security alerts and provide incident management support.
• Threat Intelligence: Support the Threat Intelligence pillar by gathering, analysing, evaluating and fusing Threat Intelligence information from a variety of sources, such as dedicated feeds, intelligence networks or from the open internet.
• Hunting Support: Support the Threat Hunting pillar through deep technical investigation and analysing feeds from the Microsoft Defender ATP tool.
• Feed Onboarding: Conduct technical feed onboarding activities into the CSOC (Cyber Security Operations Centre) SIEM (Security Information and Event Management tool), tuning the feed once complete.

• Query Response: Respond to ad‑hoc queries to the team mailbox.
• Security Advice: Provide professional advice to Vitality business areas on Information Security best practice.
• ISMS Management: Assist in the development, maintenance and improvement of the Information Security Management System (ISMS), so that certification to ISO27001 is maintained.
• Tool Configuration: Mature the configuration of technical Security tools within Vitality.
• Project Contribution: Contribute to Information Security initiatives/projects, including TPAM, RBAC, MSS.
• Penetration Support: Assist in facilitating penetration tests and manage remediation of findings.
• Risk Management: Engagement with project managers to ensure risks are identified and are being addressed through the SDLC.
• Supplier Due‑Diligence: Undertake security due diligence on third‑party suppliers including site visits.
• System Monitoring: Active monitoring of security systems and tools, respond to alerts from these and escalate.
• Incident Management: Participate in the management of Information Security incidents.
• Continuous Improvement: Contribute to the continuous improvement of Vitality’s Information Security posture.
• Threat Awareness: Maintain up‑to‑date knowledge of latest threats and trends.
• Training Development: Contribute to the development of information security training and awareness activities.
• Reporting Metrics: Provide accurate reporting metrics.

• Event Response: Responding to security events, requests and incidents logged in management systems.
• Risk Monitoring: Ongoing identification and monitoring of security risks.
• Posture Monitoring: Monitoring the security posture of the IT estate and identifying anomalous activity and behaviours by the use of Security Information and Event Management (SIEM) tools.
• Log Analysis: Performing analysis of log files, systems, and network traffic.
• Threat Hunting: Hunting for suspicious activity based or anomalous activity and escalating.
• Incident Documentation: Documenting and maintaining incident response actions.
• SIEM Innovation: Innovating in the areas of SIEM and SOC.
• Initial Response: Monitoring and initial response to potentially‑malicious or anomalous activity based on event data from a wide range of IT systems components, including SIEM, IDS/IPS, Firewalls, WAF, Web Access Security and DLP systems, and other sources.
• Issue Triage: Performing triage of incoming issues and escalation to, and liaison with, other operational areas as part of security incident identification and response.
• Vulnerability Scanning: Performing regular vulnerability scanning over internal and external infrastructure.
• Vulnerability Mitigation: Working with other teams to identify, resolve, and mitigate vulnerabilities in systems.
• Metrics Reporting: Produce and review daily, weekly and monthly metrics for security events.
• Reverse Engineering: Perform vulnerability scanning and reverse engineering.
• Trend Awareness: Stay up-to-date with trends in the information security community including new vulnerabilities, methodologies, and products.

• Shift Supervision: Ensuring all monitoring functions are covered for the full shift period.
• Reporting Compliance: Ensuring all reporting requirements are met.
• Task Completion: Ensuring all checks are completed.
• Analyst Supervision: Ensuring all Tier One analysts are supervised.
• Staffing Management: Ensuring manpower levels are kept at least at the minimum manning level.
• TAC Responsibility: Responsible for the TAC 24/7/365 function for the length of the shift.
• Handover Management: Conduct and document formal handover and takeover of shift.
• Liaison Coordination: Liaise with Tier 3 Analysts for daily continuity briefs.
• Issue Liaison: Liaise with Tier 3 Analyst for any new or ongoing service status issues.
• Service Monitoring: Monitor and maintain service status for CTAC.

• System Administration: Administer cybersecurity‑related systems and global infra