Cyber Defense & Vulnerability Operations Analyst

The Cyber Defense & Vulnerability Operations Analyst supports Navy ERP through continuous security monitoring, alert analysis, and enterprise vulnerability management. This role investigates and responds to indicators of compromise across databases, operating systems, and middleware. The specialist oversees required scanning, tracks compliance, and submits data to DoD repositories, including VRAM and CMRS. They also lead remediation meetings with database, application, and infrastructure subject matter experts to address identified vulnerabilities.

The following reflects management’s definition of essential functions for this job but does not restrict the tasks that may be assigned. 

• Security Operations & Alert Monitoring:
  • Monitor real-time security alerts from Splunk, Tripwire, and HBSS in accordance with SOPs.
  • Triage, analyze, and escalate suspicious events, anomalous behaviors, and security incidents.
  • Conduct deep-dive activity monitoring across core Navy ERP architecture:
    • Databases: SAP HANA, Oracle, and Sybase.
    • Operating Systems: Windows Server and Linux host activities.
    • Applications & Middleware: Tripwire, webMethods, IBM Tivoli, and integration layers.
• SIEM Content & Correlation Rule Engineering:
  • Develop, refine, and optimize correlation searches within Splunk Enterprise Security.
  • Tune detection logic to eliminate false positives and enhance detection fidelity.
  • Design custom Splunk dashboards, scheduled alerts, and compliance tracking metrics.
  • Define data requirements and logging standards for new inbound data sources.
• Vulnerability Scanning & Asset Coverage:
  • Schedule, execute, and validate weekly and ad-hoc ACAS (Tenable) vulnerability scans.
  • Schedule, execute, and review weekly and ad-hoc Onapsis scans across SAP instances.
  • Ensure 100% of Navy ERP assets receive required policy scans.
  • Monitor HBSS/ESS agent coverage across all endpoints; coordinate with NAWC-AD data center HBSS admins.
• Compliance Reporting & DoD Systems of Record:
  • Export verified ACAS scan results and upload directly into VRAM.
  • Consolidate vulnerability data and HBSS status metrics for regular submission into CMRS.
  • Generate and distribute detailed vulnerability assessment reports to technical SMEs.
• Cross-Team Collaboration & Stakeholder Reviews:
  • Lead or back up weekly vulnerability review meetings with system, database, and platform SMEs.
  • Track remediation milestones and validate post-remediation re-scans.
• Documentation & Governance:
  • Maintain and update threat response playbooks, scanning schedules, and operational SOPs.

• Experience: 4+ years in SOC analysis, cyber defense, or vulnerability assessment within DoD/Navy environments.
• SIEM Proficiency: Advanced knowledge of Splunk (SPL query language, Enterprise Security, correlation searches, alerting).
• Vulnerability & Endpoint Tooling: Hands-on operational experience with:
  • Tenable ACAS (Nessus and SecurityCenter).
  • DoD HBSS/ESS (Trellix ePO, agent verification, module status).
• Compliance Systems: Direct experience uploading and tracking vulnerability data in VRAM and CMRS.
• Technical Breadth: Foundational understanding of enterprise databases (SAP HANA, Oracle) and OS security.
• Certifications:
  • DoD 8570/8140 CSSP Analyst or IAT II/III baseline (e.g., CySA+, CEH, CASP+ CE, CISSP).

• Splunk Certified Cybersecurity Defense Analyst or Splunk Core Certified Advanced Power User.
• DISA HBSS 201/301 Administrator training or Tenable ACAS certification.
• Prior experience coordinating with NAWC-AD or Navy program office cyber teams.

Physical Requirements: The ideal candidate must at a minimum be able to meet the following physical requirements of the job with or without a reasonable accommodation:  

• Ability to perform repetitive motions with the hands, wrists, and fingers.  
• Ability to engage in and follow audible communications in emergency situations.  
• Ability to sit for prolonged periods at a desk and working on a computer.