Previous Job
Previous
IT Security Analyst 3- Incident Response
Ref No.: 18-73675
Location: Dimondale, Michigan
Start Date: 10/04/2018
 
Status New
Position # 577530
Position IT Security Analyst 3- Incident Response
Client & Department State of Michigan- DTMB- MCS
Worksite Address Dimondale, MI
Tenure 12+ Months
No. of Openings 3 (INTERVIEW TYPE: Either Webcam or In Person)
No. of submittals 3










SKILL MATRIX:
Skill Required / Desired Amount of Experience Candidate Experience Last Used
In-depth knowledge of security monitoring and incident response Required 2 years    
Knowledge of conducting security investigations. Required 2 years    
Experience with using and customizing SIEM products. Desired 2 years    
Solid understanding of network protocols and architecture. Required 2 years    
Demonstrated experience with performing digital forensics and incident response using industry leading tools. Required 2 years    
Experience with network intrusion detection and analysis tools such as Bro, Suricata, Sourcefire, Snort and Wireshark. Required 2 years    
Demonstrated experience operating information security tools is required. Required 2 years    
Understanding of the tactics, techniques and procedures of advanced attackers Required 2 years    
SANS Training Desired      
CISSP Desired      
3-5 years of experience in Security Operations and Incident Response. Required 3 Years    
 
SHORT DESCRIPTION: Monitor and advise on information security issues related to the systems and workflow at an agency to ensure the internal IT security controls for an agency are appropriate and operating as intended.
 
COMPLETE DESCRIPTION: Years of Experience:
5 or more years of experience in the field.
 
Job Description:
  • Member of the Michigan Security Operations Center (MiSOC) and will focus on Incident Response.
  • Identify security issues and risks associated with security events and manage the incident response process.
  • Participate in the incident response and investigation process for identified security events.
  • Use the Security Incident Event Management (SIEM) platform (IBM's QRadar) to perform Incident Response identification and response.
  • Perform network and system forensics in response to security incidents.
  • Optimize and customize security-monitoring tools to improve detection.
  • Hunt for signs of APT activities.
  • Maintain and update the security operational workflow.