Cybersecurity Operations Specialist II (Enterprise Audit)
Req #: 243433
Job Category:Information Technology
Minimum Clearance Required: TS/SCI
CACI is the winner of a new long-term contract with the National Geospatial-Intelligence Agency (NGA) for Transport & Cybersecurity Services (TCS) contract. The functional capabilities are to provide the information technology (IT) infrastructure services required to deliver timely, relevant, and accurate GEOINT in support of national security. TCS will provide innovative design, engineering, procurement, implementation, operations, sustainment and disposal of transport and cybersecurity IT services on multiple networks and security domains, at multiple locations worldwide to support the NGA GEOINT mission.
CACI is seeking a motivated, career and customer-oriented Cybersecurity Operations Specialiststo perform on our Cybersecurity Data Analysis Services team.
What You’ll Get to Do:
As a team member you will have the opportunity to provide cybersecurity data analysis services, which designs, develops, builds, tests, configures, employs, operates, integrates, sustains, and refreshes the Security Information Events Management (SIEM) capability (i.e. Enterprise Audit), long-term analytics platform, log aggregation platform, and the cyber threat intelligence capability, signature development and deployment, and reputation management services. This includes the onboarding of all new and existing IT resources and ensuring the correct routing of all audit events to mission partners in accordance with Intelligence Community Standards (ICS) 500-27.
More about your role:
Provide all preventative and corrective maintenance to ensure consistent, reliable, and secure service availability. This includes all actions required to return the service to full operational capability such as vendor RMA processes, removal and proper disposal of broken equipment/software, installation and testing of new equipment/software, and configuration of new equipment/software
Maintain system availability and reliability with a threshold of 99.99%
Detect and ticket degradations (volume/velocity) of all SIEM data flows within 60 minutes of the start of the degradation
Perform day-to-day maintenance, and specific scheduled maintenance activities that result from manufacturers recommended service intervals, alerts, bulletins, available patches, and updates according to agency approved change management processes. This includes maintaining updated documentation, change logs, and service bulletin libraries for all supported equipment and software in the Cybersecurity Operations Cell (CSOC) knowledge management platform
Execute emergency maintenance actions with sufficient urgency to preclude unacceptable outage durations, approved by the Government prior to execution, and coordinated through and approved by CSOC and ESC government management
Perform all development, engineering, testing, integration, and implementation actions necessary for major vendor revisions
Perform continuous engineering assessments to improve the performance, effectiveness, coverage, and maturity of this service.
Retain documentation regarding loss of event logs (e.g. June 5-7th DNS logs were not ingested from SBU and are lost)
Configure all assets assigned to this service within the Government Furnished Information - Software Tools list in accordance with all Federal, DoD, IC, and NGA laws, directives, orders, polices, guidance, procedures etc.
Perform all development, design, engineering, testing, integration, and implementation actions needed for the total integration and interoperability between all applicable assets in the Government Furnished Information - Software Tools list. This includes ensuing all data flows are properly parsed for ingestion/transmission to internal and external automated reporting systems (e.g. JFHQ DoDIN – Joint Incident Management System, DoD CIO – DoD Scorecard/Get to Green reporting, IC CIO – Cybersecurity Performance Evaluation Model reporting, etc.)
Utilize agency approved ticketing systems to document, track, assign, update, and coordinate all engineering, integration, configuration, and maintenance actions
Use various monitoring, analysis, and visualization tools to track effectiveness, status, performance metrics, and other information as needed or required by Government staff and contractors assigned Cybersecurity Operations Services and Cybersecurity Readiness Services