Subject Matter Expert I

Job Description

Job Description

Title: Subject Matter Expert I

Description:
Solutions³ LLC provides support for on- and offsite incident response to government agencies and critical infrastructure owners who experience cyber-attacks. Solutions³ LLC delivers advanced technical assistance, proactive hunting, rapid onsite incident response, and immediate investigation using host- and network-based cybersecurity analysis capabilities. Personnel perform investigations to characterize the severity of breaches and develop mitigation/remediation plans.

Solutions³ LLC is seeking a Subject Matter Expert with deep expertise in one or more edge device technologies (Cisco, Ivanti, Palo Alto, Ciena, Juniper) to support this critical customer mission.

Salary Range: $131,000 - $150,000
Location: Arlington, VA
Job Type: Onsite

Eligibility:  

• Must be a  US Citizen  
• Must have an  active TS/SCI clearance
• Must be able to obtain DHS Suitability prior to starting employment  
• 10+ years of directly relevant experience

Responsibilities Include:  

• Serves as a hunt and incident response subject matter expert (SME), applying in-depth knowledge of threat actor tools, techniques, and procedures (TTPs), with a focus on network centric and edge device compromises.
• Serves as an incident response expert in support of a technology insertion team, evaluating and integrating new network forensic and monitoring capabilities.
• Assists the Government lead in coordinating teams for preliminary incident response investigations, including onsite and remote engagements.
• Assists the Government lead by interfacing with the customer while onsite, clearly communicating status, findings, and recommendations.
• Characterizes and analyzes network traffic (including PCAP, flow, and device logs) to identify anomalous activity and potential threats to network resources.
• Identifies and analyzes anomalies in network traffic using metadata (e.g., flow records, DNS logs, proxy logs) to detect and scope malicious activity.
• Reconstructs malicious attacks or activities based on network traffic, including timelines, attacker paths, and data exfiltration patterns.
• Examines network topologies to understand data flows, trust boundaries, and potential choke points; uses this understanding to inform hunt and response activities.
• Assesses network topology and device configurations, identifying critical security concerns and providing security best practice recommendations, especially for Cisco, Ivanti, Palo Alto, Ciena, and Juniper platforms.
• Determines appropriate courses of action in response to identified and analyzed anomalous network activity, including containment, eradication, and hardening actions.
• Applies knowledge of defense-in-depth principles and general attack stages to evaluate and improve network security architecture and edge-device configurations.
• Applies knowledge of network device integrity concepts and methodologies to validate device state, detect unauthorized modification, and recommend remediation.
• Leads analysis of device logs, configurations, and telemetry from routers, switches, firewalls, VPNs, and remote access appliances to identify, scope, and reconstruct intrusions.
• Provides expert support, analysis, and research with only broad direction into exceptionally complex problems and processes relating to hunt and incident response activities.
• Serves as a technical expert on high-level incident response teams, providing technical direction, interpretation, and alternatives for network-centric incidents.
• Exercises considerable latitude in determining technical objectives and independently develops technical solutions to complex problems requiring ingenuity and creativity.
• Analyzes incident data and victim environments to recommend targeted mitigations, including network segmentation, policy updates, and device hardening.
• Advises technical personnel on countermeasure implementation and customization (e.g., firewall rules, IPS signatures, access control lists).
• Supports internal stakeholders on containment and eradication missions, on-site and remotely.
• Ensures evidence integrity is preserved according to standard operating procedures or national standards when collecting network data, device artifacts, and logs.
• Assists with the writing and publishing of Computer Network Defense (CND) guidance and detailed reports on incident findings to appropriate constituencies.
• Distills analytic findings into executive summaries and in-depth technical reports suitable for both leadership and highly technical audiences.
• Documents analysis, TTPs, and device specific incident handling procedures in a standardized knowledge base for sharing and publication.
• Assists in maintaining branch process and procedure documentation and guides the completion of hunt and incident response activities.

Required Skills:  

• 3+ years of experience related to the evaluation and implementation of new cyber response or network forensic capabilities.
• Hands-on experience with incident response or network operations involving enterprise edge devices from at least two of the following vendors: Cisco, Ivanti, Palo Alto, Ciena, Juniper.
• Strong understanding of network architecture and security, including routing, switching, VPNs, firewalls, segmentation, and defense in depth.
• Knowledge of Computer Network Defense (CND) policies, procedures, and regulations relevant to U.S. government or similar environments.
• Ability to:
  • Characterize and analyze network traffic to identify anomalous activity and potential threats.
  • Identify and analyze anomalies in network traffic using metadata (flow, DNS, proxy, etc.).
  • Reconstruct malicious activity based on network traffic and device logs.
• Understanding of general attack stages (reconnaissance, initial access, lateral movement, exfiltration, etc.) and how they manifest across the network.
• Understanding of system and application security threats and vulnerabilities and how they are observed in network traffic.
• Understanding of proactive analysis of systems and networks, including establishing trust levels of critical resources and detecting anomalous behavior.
• Proficiency with common operating systems (e.g., Linux/Unix, Windows).
• Experience performing cyber incident response (scoping, containment, eradication, recovery) in operational environments.
• Ability to think independently, make sound decisions under pressure, and work with limited guidance.
• Superior written and oral communication skills, including the ability to clearly explain technical issues to both technical and non-technical stakeholders.