Watch Analyst

Peraton is currently seeking to hire a Watch Analyst for its' Federal Strategic Cyber group.

Location: Arlington, VA (on site)

This position is part of DHS Cybersecurity Infrastructure Security Agency’s (CISA) 24/7 SCIF/Operations Center, which is the hub for staying on top of threats and emerging risks to our nation’s critical infrastructure. Through this operation center, the federal government coordinates situational awareness and response to protect national cyber and infrastructure security.

As the Watch Analyst in this role, you will: 

• Monitor classified databases, the ticket management system, subscription-based alerting services, cable and local news, social media, and other open sources for threats to the nation’s critical infrastructure and global operations impacting national security.
• Provide the initial triage and analysis of cyber, physical, and communication incidents to identify the severity of impact to critical infrastructure and determine the level of reporting or briefing required.
• Work with a small team to provide accurate, timely, and actionable reports to our government leadership, law enforcement, federal stakeholders, and partners. The team will coordinate incidents affecting critical infrastructure through incident completion.
• Be an experienced Operations/Intelligence/Cyber practitioner with the ability to work in a time-sensitive operational environment. Watch Analysts must maintain strict adherence to security protocols and confidentiality requirements in handling sensitive information.
• Be able to multitask, make quick decisions, and utilize critical thinking skills in a time sensitive environment under the direction of a federal CISA Duty Officer.
• Be detail-oriented and have strong analytical skills with the ability to evaluate data, synthesize information, and write reports.
• Need to understand the operation of all communications and information technology hardware and software utilized to perform daily functions.
• Have the ability to troubleshoot all equipment issues as needed and coordinate a resolution with the help desk.
• Other services and support as needed or directed by the government client.
• The candidate will work at a 24x7x365 Classified Operations and Watch Center.
• Shifts are assigned based on the needs of the team and may include rotating assignments.

#CISA 

Minimum Qualifications:

• Bachelor’s degree with a minimum of 3 years related technical experience, with at least one (1) year of specialized operations center experience. 4 additional years of related experience may be substituted in lieu of a degree.
• Demonstrated excellent written and verbal communication skills. Must have broad expertise in research, analysis, and report writing skills. 
• Must be flexible and able to work within a 24x7x365 operations support environment. 
• Experience with open-source analysis and alerting systems.
• Knowledge of Microsoft Office automation solutions.
• Must have experience/expertise in one or more critical infrastructure sectors (as defined by HSPD-7 and the NIPP), cyber and/or emergency management. 
• Must have Knowledge of National Incident Management System (NIMS) structure, emergency management operations, and background knowledge of one (1) or more critical infrastructure sectors.
• Must complete FEMA IS-100.c, IS-453, IS-520, IS-545.a, IS-551, IS-700.b, IS-800.d, IS-860.c and IS-1300 before first day on the contract.
• U.S. citizenship is required. 
• An active Top Secret security clearance required.
  • In addition, you must be able to obtain and maintain a favorably adjudicated DHS background investigation for continued employment.

Preferred Qualifications:

• Experience in drafting and publishing national level reporting.
• Experience with email triage and requests for information (RFIs).
• Experience as an All-Source Intelligence Analyst in Joint Operations Center and/or Fusion Center.
• Experience with cyber incident management and analysis.
• Obtained Cyber certifications (i.e., CompTIA Security+)
• Experience with Knowledge Management Systems and ServiceNOW.
• Has the ability to read technical cyber reporting, including IOCs and TTPs, and be able to extract the important information to provide clear and concise reporting for a non-technical audience.