Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world’s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees do the can’t be done by solving the most daunting challenges facing our customers. Visit peraton.com to learn how we’re keeping people around the world safe and secure.
ResponsibilitiesPeraton is seeking an experienced CIRT Tier 2 Analyst to join Peratons' Federal Strategic Cyber Mission program.
Location: Beltsville, MD; On-site
Work Hours: Mid Shift, 22:00– 6:00 EST, SUN-THU
In this role, you will:
- Detect, classify, process, track, and report on cyber security events and incidents.
- Perform advanced in-depth analysis of coordinated Tier 1 alert triage and requests in a 24x7x365 environment.
- Analyze logs from multiple sources (e.g., host logs, EDR, firewalls, intrusion detection systems, servers) to identify, contain, and remediate suspicious activity.
- Characterize and analyze network traffic to identify anomalous activity and potential threats.
- Protect against and prevent potential cyber security threats and vulnerabilities.
- Perform forensic analysis of hosts artifacts, network traffic, and email content.
- Analyze malicious scripts and code to mitigate potential threats.
- Conduct malware analysis to generate IOCs to identify and mitigate threats.
- Collaborate with Department of State teams to analyze and respond to events and incidents.
- Monitor and respond to the CIRT Security Orchestration and Automation Response (SOAR) platform, hotline, email in-boxes.
- Create tickets and initiate workflows as instructed in technical SOPs.
- Coordinate and report incident information to the Cybersecurity and Infrastructure Security Agency (CISA).
- Collaborate with other local, national and international CIRTs as directed.
- Submit alert tuning requests.
Required:
- Bachelor's degree and 2 years of experience.
- An additional 4 years of experience may be substituted in lieu of the degree bachelors degree requirement.
- Must possess or be able to obtain at least one of the following certifications before start date:
- CCNA-Security
- CND
- CySA+
- GICSP
- GSEC
- Security+ CE
- SSCP
- Continued certification is required as a condition of employment.
- Demonstrated experience in the Incident Response lifecycle.
- Knowledge of SOAR ticketing and automated response systems (e.g. ServiceNow, Splunk SOAR, Microsoft Sentinel).
- Demonstrated experience with using Security Information and Event Management (SIEM) platforms (e.g. Splunk, Microsoft Sentinel, Elastic, Q-Radar).
- Demonstrated experience in using Endpoint Detection and Response systems (e.g. MDE, ElasticXDR, CarbonBlack, Crowdstrike).
- Knowledge of cloud security monitoring and incident response.
- Knowledge of integrating IOCs and Advanced Persistent Threat actors.
- Ability to analyze cyber threat intelligence reporting and understanding adversary methodologies and techniques.
- Knowledge of malware analysis techniques.
- Knowledge of the MITRE ATT&CK and D3FEND frameworks.
- U.S. Citizenship required.
- Active Secret security clearance required in order to start.
Preferred:
- Proficiency with Splunk for security monitoring, alert creation, and threat hunting.
- Knowledge of Microsoft Azure access and identity management.
- Proficiency with Microsoft Defender for Endpoint and Identity for security monitoring, response, and alert generations.
- Experience in using digital forensics collection and analysis tools (e.g. Autopsy, MagnetForensics, Zimmerman Tools, KAPE, CyLR, Volatility).
- Experience with using ServiceNow SOAR for ticketing and automated response.
- Knowledge of Python, PowerShell and BASH scripting languages.
- Experience with cloud security monitoring and incident response.
- Demonstrated ability to perform static/dynamic malware analysis and reverse engineering.
- Experience with integrating cyber threat intelligence and IOC-based hunting.
- Technical certifications such as:
- Security+, CySA+, Cloud+, Try Hack Me SAL1, Hack the Box CDSA, CyberDefenders, CCD, Azure SC-900, CCSP, GCIH, CCSK, GSEC, CHFI, GCLD, GCIA
- Advanced technical certifications such as:
- SecurityX/CASP+, PRMP, GREM, GEIR, GNFA, or GCFA
Peraton offers eligible employees a variety of benefits including medical, dental, vision, life, health savings account, short/long term disability, EAP, parental leave, 401(k), paid time off (PTO) for vacation, and company paid holidays. A full listing of available benefits can be viewed at https://www.careers.peraton.com/benefits.
Application StatementsThe application period for the job is estimated to be 30 days from the job posting date. However, this timeline may be shortened or extended depending on business needs and the availability of qualified candidates. By applying to this job, you are expressing interest in the role and the Company. During the review of your application, you may be required to participate in an on-camera interview, as well as participate in a process to verify your identity. Use of artificial intelligence (AI) tools of any kind during Peraton interviews is strictly prohibited unless the candidate has obtained prior written authorization. All interview responses must be the candidate’s own. EEOEEO: Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.Skills Required
- Bachelor’s degree and 2 years of experience; an additional 4 years of experience may substitute for the degree.
- Possess or obtain an approved cybersecurity certification before the start date, including CCNA-Security, CND, CySA+, GICSP, GSEC, Security+ CE, or SSCP; continued certification is required.
- Demonstrated experience with the incident response lifecycle.
- Knowledge of SOAR ticketing and automated response systems such as ServiceNow, Splunk SOAR, or Microsoft Sentinel.
- Demonstrated experience using SIEM platforms such as Splunk, Microsoft Sentinel, Elastic, or QRadar.
- Demonstrated experience using EDR systems such as Microsoft Defender for Endpoint, ElasticXDR, Carbon Black, or CrowdStrike.
- Knowledge of cloud security monitoring and incident response.
- Knowledge of IOC integration and Advanced Persistent Threat actors.
- Ability to analyze cyber threat intelligence reporting and adversary methodologies and techniques.
- Knowledge of malware analysis techniques.
- Knowledge of MITRE ATT&CK and D3FEND frameworks.
- U.S. citizenship.
- Active Secret security clearance required to start.
- Proficiency with Splunk for security monitoring, alert creation, and threat hunting.
- Knowledge of Microsoft Azure access and identity management.
- Proficiency with Microsoft Defender for Endpoint and Identity.
- Experience with digital forensics collection and analysis tools, such as Autopsy, Magnet Forensics, Zimmerman Tools, KAPE, CyLR, or Volatility.
- Experience using ServiceNow SOAR for ticketing and automated response.
- Knowledge of Python, PowerShell, and Bash scripting languages.
- Experience with cloud security monitoring and incident response.
- Ability to perform static and dynamic malware analysis and reverse engineering.
- Experience integrating cyber threat intelligence and conducting IOC-based hunting.
- Technical certifications such as Security+, CySA+, Cloud+, SAL1, CDSA, CyberDefenders, CCD, Azure SC-900, CCSP, GCIH, CCSK, GSEC, CHFI, GCLD, or GCIA.
- Advanced technical certifications such as SecurityX/CASP+, PRMP, GREM, GEIR, GNFA, or GCFA.
Peraton Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Peraton and has not been reviewed or approved by Peraton.
-
Healthcare Strength — Healthcare offerings are described as broad, including medical, dental, vision, mental health support, and specialty programs like virtual physical therapy and surgical/cancer care navigation. Medical coverage is also characterized as a standout part of the overall package in terms of perceived quality.
-
Retirement Support — Retirement support includes a 401(k) with employer matching and is repeatedly positioned as a strong component of total rewards. The 401(k) benefit is frequently singled out as one of the most valued parts of the package.
-
Leave & Time Off Breadth — Time-off benefits are positioned as robust, including PTO, holidays, paid sick days, and floating holidays, with some roles offering notably generous accrual. Leave breadth is reinforced by related programs such as short/long-term disability and bereavement leave.
Peraton Insights
What We Do
Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world’s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees do the can’t be done by solving the most daunting challenges facing our customers. Visit peraton.com to learn how we’re keeping people around the world safe and secure.
Why Work With Us
We are fearlessly solving the world’s most complex challenges to keep people safe and secure. You can be a part of protecting and promoting that freedom around the world.
Gallery
