Cyber Security Analyst

Boston Government Services, LLC (BGS) is an engineering, technology, and security firm dedicated to supporting government programs and national security efforts. They are seeking a Cyber Security Analyst to assist in monitoring and responding to security incidents, performing account management, and analyzing data to enhance security measures.

Responsibilities:

• Resetting user passwords for cause (e.g., when they have been identified as being suspected compromised or 'known compromised')
• Working with service owners to reset service account passwords for various reasons
• Ensuring authorizers are designated for in-scope accounts
• Analyzing usage patterns for accounts (e.g., service, administrative) to identify inactive accounts or inappropriate account use
• Reviewing approval requests for various new access or accounts
• Triaging unusual access requests (e.g., access from 3 rd party VPN providers, impossible travel) or phishing reports
• Evaluate endpoint and detection response (EDR) installation and coverage
• Identify systems without EDR and provide to IT teams for remediation
• Monitoring external attack surface for unapproved systems, undocumented systems, and newly disclosed vulnerabilities
• Reviewing systems with existing public access to ensure requirements for these systems are followed (e.g., event logging, multifactor authentication)
• Attend online/Teams meetings with team and others as appropriate
• Work with team to provide status on current task, suggest improvements, discuss implementation, etc
• Analyze data and perform initial planning to address identified issues
• Assist with the creation of playbooks to address identified issues
• Seek to understand the intention of detections and corresponding playbooks
• Execute various playbooks dealing with identified issues with minimal assistance (e.g., identification of compromised passwords, inappropriate use of administrative accounts, systems not providing event logs, systems without a functional EDR installed)
• Adapt on-the-fly when an existing playbook is insufficient
• Provide basic feedback on playbooks and detections
• Produce clear reports (MTTD/MTTR, FP rate, backlog) for technical and executive audiences; maintain thorough case notes
• Recommend additional new use cases for detections based on an analysis of threats and data
• Identify telemetry quality and visibility issues (SIEM parsing/normalization, EDR/XDR sensor health, asset/identity tagging)
• Conduct proactive threat hunts; convert findings into new detections and control recommendations
• Create advanced use cases for detections based on an analysis of threats and data, including sample criteria to identify the behavior and mapping detections to MITRE Telecommunication & CK
• Drive continuous improvements to existing processes or tooling
• Perform quality reviews and improve handoffs/runbooks
• Coach, guide, teach others on the team
• Lead investigations end-to-end (triage to containment), delivering timelines, root cause, scope, IOCs, and impacted assets
• Execute/coordinate containment and remediation (host isolation, credential resets, blocks) with proper approvals and verification

Requirements:

• 1–3 years in a SOC, cyber security 'blue team', or closely related role
• Strong grasp of TCP/IP, OSI model, and common protocols (HTTP, DNS, SMTP)
• Windows/Linux/macOS fundamentals; Active Directory/Azure AD concepts; basic cloud logging
• Experience with at least one SIEM and one EDR/XDR platform
• Experience with ticketing/case management
• Ability to craft queries using common languages; comfort with regex, JSON and APIs; basic scripting in Python/PowerShell/Bash
• Excellent analytical, problem-solving, and communication skills both with stakeholders, peers, and internal customers; able to operate under pressure in a shift or on-call environment
• Must be a U.S. citizen
• Successful drug screening
• Experience in system and network administration
• Staying up to date with the latest cyber security threats, vulnerabilities, and best practices
• Strong analytical and problem-solving skills
• Meticulous attention to detail to ensure thorough assessments and accurate reporting
• Excellent written and verbal communication skills to effectively convey findings and recommendations to technical and non-technical stakeholders
• Ability to work collaboratively with other cyber security professionals, IT staff, and external vendors
• Considerable knowledge/experience of assessing security controls
• Experience and skill in conducting audits or reviews of technical systems
• Experience working in a government environment
• Experience working in a distributed IT environment
• Ability to qualify for HSPD-12 card for use in two-factor authentication
• Able to work both independently and as a contributing member of a small technical team
• Able to disseminate knowledge to current staff
• 3–5 years relevant experience including investigations, data analysis, and detection tuning
• Comfort using Splunk Processing Language (SPL), CrowdStrike EDR, and ServiceNow
• Experience with SOAR tools and automation development
• Experience using identity security/management tools (e.g., Entra ID, Active Directory, Shibboleth, CrowdStrike Identity Protection)
• Cloud security experience (e.g., CloudTrail/GuardDuty, Azure Defender/M365, GCP Security Command Center)
• Basic forensics skills and network analysis fundamentals (host triage, timelines, artifact analysis, packet/PCAP review)
• Understanding of the Cyber Security Framework (CSF) and NIST 800-53 controls