Intrusion Detection Analyst Jobs (NOW HIRING)

POSITION: Intrusion Detection Monitoring and Incident Management Support
LOCATION: O'Fallon, Illinois, Scott Air Force Base
REQUIRED SECURITY CLEARANCE: Secret
POSITION TYPE/STANDARD WORK HOURS: Full-time 40 hours per week
THE OPPORTUNITY:
The United States Transportation Command (USTRANSCOM) located at Scott Air Force Base (AFB), IL, is one of 11 Unified Combatant Commands (UCC). USTRANSCOM provides command and control (C2) for the synchronized transportation, distribution, and sustainment of personnel and assets, making possible the projection and maintenance of national power wherever needed with speed and agility, high efficiency, and a high level of trust and accuracy.
USTRANSCOM operates the Common Computing Environment (CCE) surrounded by a network defense infrastructure. The USTRANSCOM CCE, supported by TCJ6 and USTRANSCOM Component Commands, is comprised of several operating systems on clients and servers, both physical and virtual. The diversity of applications riding on the USTRANSCOM CCE (C2 systems, information management systems, mail/message systems, and security systems) increases the complexity and difficulty to integrate new system requirements. The information security infrastructure operating with the USTRANSCOM CCE is a unique integration of products demanding a high degree of technical skills and understanding.
The Intrusion Detection Monitoring and Incident Management support position will execute intrusion detection monitoring and incident response and management processes and procedures IAW DoD and USTRANSCOM policies and direction. This position will provide intrusion detection monitoring, analysis, and incident management activities on-site 24/7/365 at Scott AFB.
WHO WE ARE:
BTAS is a woman-owned small business founded in 1995, located near Wright-Patterson Air Force Base in Beavercreek, OH. We have earned national and regional awards in the Department of Defense for our proven IT, Engineering, and Program Management capabilities.
We are committed to working with exceptional quality and professionalism to deliver excellence to our customers, while providing our employees with a stimulating and satisfying work environment as we collaborate with teammates to achieve common goals.
PRIMARY RESPONSIBILITIES:
Intrusion detection/analysis/incident management activities will be performed for all USTRANSCOM information systems/networks that subscribe to USTRANSCOM CSSP services. The intrusion detection monitoring and incident management tool suites consists of network and host-based sensors in all security domains and enclaves, log consolidation mechanisms, analysis platforms, and other products that may be directed or procured.
Perform the day-to-day mission execution of the intrusion detection monitoring and
incident management and response activity.

• Reviewing audit data, e-mail spam (also known as junk e-mail or unsolicited bulk e- mail), and network traffic data for irregularities or other indications of real or potential security violations.
• Correlating and analyzing security data and events from alert and traffic flow systems [e.g., intrusion detection system/intrusion prevention system (IDS/IPS), routers, Netflow, firewall].
• Identifying potential distributed, long-term, coordinated, low-visibility network-based attacks.
• Reviewing and sharing significant activity via SIGACT reports and Attack Sense and Warning (AS&W) tippers.

Perform the day-to-day operation and maintenance of the intrusion detection
monitoring and incident management tool suites.

• Maintain the existing configuration and integrity of the intrusion detection monitoring and incident management tool suite IAW applicable policies and instructions.
• Develop new intrusion detection signatures and modify the signatures at the direction of the Government; report false positive alerts IAW applicable USCYBERCOM/JFHQ DODIN orders.
• Develop and maintain security analysis scripts and analytic displays.
• Operate and maintain a service assurance capability for intrusion detection monitoring and incident management tools.

Collect and provide the Government with monthly metrics on intrusion detection monitoring and incident management activity.

• Uptime statistics based on service availability for intrusion detection monitoring and incident management tools (e.g., network and host-based sensors, log consolidation mechanisms, analysis platforms) based on service assurance monitoring.
• Number and type of cyber incidents by category IAW CJCSI 6510.01F.

Maintain current documentation on intrusion detection monitoring and incident management processes and procedures and provide the deliverable documents to the Government.
MINIMUM QUALIFICATIONS:

• 5+ years of experience with monitoring and identifying vulnerabilities, anomalies, and active threats; looking at the network from an investigative perspective, using Security Information and Event management (SEIM) tools to analyze traffic data
• CompTIA Security+ (ce) certification

DESIRED QUALIFICATIONS:

• Experience with:
  • Splunk or ELK searching log and event data.
  • An EDR solution for detection and containment capability.
  • Investigating network traffic via NetFlow and firewall data.
  • AWS cloud logs such as Route53, CloudTrail, GuardDuty, S3, RDS, VPC Flow, and config.
  • Web application logs and WAF logs.

SUPERVISORY RESPONSIBILITIES:
This position does not supervise others.
WORK ENVIRONMENT:
This job operates in a professional office environment. This role routinely uses standard office equipment.
PHYSICAL DEMANDS:
Must be able to operate a computer and other standard office equipment. Must be able to remain in a stationary position, 80%.
TRAVEL:
Minimal travel, 5 - 10%.
OTHER DUTIES:
Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities and/or activities may change at any time with or without notice.
COMPENSATION:
BTAS adheres to federal, state, and local regulations. This is a Full-Time, Salary, Exempt position. Salary is subject to a variety of factors, including but not limited to years of experience, education, certification(s), training, specialized skills, responsibilities, etc. The salary range for this position is $70,000 - $90,000 annually.
BTAS BENEFITS:
A comprehensive benefits program, including paid time off, federal holidays, health coverage, 401K plan with generous company match is offered to all full-time employees. Part-time employees may have access to limited benefits.
AAP / EEO STATEMENT:
BTAS is an equal opportunity employer, and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability status, protected veteran status, or any other characteristic protected by law.
BTAS is an E-Verify program participant.