Cybersecurity Engineer\/Network Server Administrator\n

We are currently seeking a Cybersecurity operations-focused Engineer with MS SENTINEL expertise and networking background to join our team serving the United States Military Academy (USMA) at West Point, NY. The role is onsite at USMA, however a hybrid\/remote work schedule may be accommodated, subject to contract requirements and business needs.\n

The individual assigned to support the USMA Cybersecurity Branch's mission and strategic direction will provide knowledge, techniques, and expertise in the configuration, monitoring and securing of network and network services both on premises and in the Azure cloud. \n

This position is located at The U.S. Military Academy at West Point in West Point, NY and reports to the Director of Government Programs.\n

Duties and Responsibilities:\n\n\u202fAssessing network (switches, APs, firewalls and network services Cisco ISE, Prime) cybersecurity vulnerabilities and risks and providing specific, prioritized, mitigation recommendations to the customer.\n\n\n\u00b7\u202fAdvising the customer on design and implementation options for desired capabilities relating to cyberoperations.\n\n\n\u00b7\u202fDocumentation and testing of security controls as relating to the ATO package process including reviewing and creating network diagrams, data flows and SOPs.\n\n\n\u00b7\u202fContinuous assessment and auditing of vulnerability remediation, configuration, and operation, to ensure compliance of the customer network using the eMASS and NIST controls for RMF. Active participation in activities related to security RMF life cycle.\n\n\nConfigure, plan and design incident, correlation and playbooks to assist the Cyber-Ops in addressing threat response using MS SENTINEL SIEM. \n\n\nMake recommendations to CIO\/G6 Cyber and CIO\/G6 CTO on changing of baselines to enhance security without compromising mission functionality, provide mission impact and risk analysis for any recommendations. \u00b7\u202fAssist the customer in defining best practices and technical approaches in a MS Azure (Microsoft Secure Score, Defender ATP Portal, Azure Secure Score) commercial cloud environment.\n\n\n\u00b7\u202fTrack and perform annual re-evaluation of Cyber regulations, policies, guidelines, standards, and procedures, and perform updates as needed.\n\n\n\u00b7\u202fThe individual will function as the organizational ambassador for network cyber operations and apply their expertise to support the organization's vision and strategic direction.\n\n\nAdditional duties include the following:\n\n\n\u00b7\u202fDemonstrate proficiency in understanding, articulating, and implementing best practices as it relates to complex IT projects.\n\n\n\u202f.\n\n\n\u00b7\u202fCultivate and maintain effective working relationships with customer team members, network admins, project managers, department computer officers (DCOs), and representatives of the Military Academy Directorates (MADs). Participation in multiple workgroups.\n\n\n\u00b7\u202fArticulate dissemination of information across all levels of the organization and to diverse stakeholders.\n\n\n\u00b7\u202fTranslate subject matter technical terminology into business terms and recommend alternatives to both senior management and security practitioners.\n\n\nThe above cited duties describe the general nature, and level of work performed. It is not intended as an exhaustive list of all the duties an incumbent may be expected to perform.\n\n\nFirewall: Monitor firewalls and Intrusion Prevention & Detection Systems events to determine if threats are being tracked correctly in SENTINEL and modify\/create playbooks to address deficiencies in response. Provide configuration recommendations to Cyber and Implementation teams on ways to improve security without impacting mission requirements to include industry best practices. Makes recommendations as to deployment of additional IDS\/IPS systems and configurations to protect the WREN enclave.\n\n\nSecurity Information and Event Management (SIEM): Will monitor CIO\/G6 MS SENTINEL SIEM and determine operational playbooks to be updated and created for events resulting from logs ingested from different sources including and not limited to MS Defender for Azure, Defender for Endpoints, Defender for Applications, DarkTrace, StealthWatch and other syslog devices.,. Will advise on policy tuning and baseline configuration tuning to reduce false alerts while ensuring true alerts are captured and addressed through playbooks. Will recommend implementation procedures for automatic remediation processes and ways to streamline alert remediation process based on alert types, frequency, impact, severity, and other alert criteria as defined by G6 Cyber. \n\n\nc) Network and Infrastructure: Review findings in monthly STIG checks and create tickets and POA&Ms in working with the Cyber-Ops team. Review and create networking diagrams as necessary for the RMF documentation. Evaluate security posture against the compliance requirements and mange vulnerability tracking and remediation to enhance the overall RMF package assessment and authorization process. Assist with implementation and design as required for the network as a whole and for individual assets, in the core and edge, of on premises infrastructure and advise in the Azure network security design. Make recommendations to CIO\/G6 Cyber and CIO\/G6 CTO on changing of baselines to enhance security without compromising mission functionality, provide mission impact and risk analysis for any recommendations. Assists Cyber team with research into different settings and tools. Evaluates recommended changes for system impact, ability to implement, and security enhancement.\n\n
\n

Minimum Qualifications:\n\n\u00b7\u202fIntermediate Network Administrator, Vulnerability Assessor, or Security Control Assessor certification (Security+, CCNA, GSEC, etc.).\n\n\n3 Years experience in Cyber Security\u00b7\u202f\n\n\nIntermediate to advanced level of experience with MS SENTINEL SIEM, specifically around playbooks and automation of threat response.\n\n\n\u00b7\u202fKnowledge of configuration management and quality assurance concepts and guidelines such as AGILE, Information Technology Infrastructure Library (ITIL), Institute of Electrical, and Electronic Engineers (IEEE), National Institute of Standards and Technology (NIST), Software Engineering Institute (SEI), Capability Maturity Model Integration (CMMI), and Project Management Body of Knowledge (PMBOK).\n\n\n\u00b7\u202fKnowledge of NIST Special Publication 800-53.\n\n\n\u00b7\u202fKnowledge of DoD Risk Management Framework (e.g., DoD Instruction 8510.01)\n\n\n\u00b7\u202fFamiliarity of IT Ticketing systems.\n\n\n\u00b7\u202fMust possess technical knowledge, both of current technology and emerging trends.\n\n\n\u00b7\u202fStrong communication (written and verbal) skills.\n\n\n\u00b7\u202fAbility to build relationships across a diverse stakeholder environment.\n\n\n\u00b7\u202fHighly organized and detail oriented.\n\n\n\u00b7\u202fAbility to manage competing priorities in a fast-paced environment.\n\n\nPreferred Qualifications:\n\n\n\u00b7\u202fBachelor's Degree in related technical discipline; or an Associate's Degree with 3+ years of experience.\n\n\n\u00b7\u202fKnowledge of Army's Enterprise Mission Assurance Support Service (eMASS).\n\n\n\u00b7\u202fExperience with Assured Compliance Assessment Solution (ACAS) findings and resolution.\n\n