Cybersecurity Blue Team Analyst – Senior

Minimum Qualifications

The Senior Cybersecurity Blue Team Analyst serves as a technical authority for cybersecurity assessment and defensive cyber operations across complex enterprise IT environments. The analyst leads assessments of infrastructure, applications, networks, cloud environments, security architectures, and enterprise services; evaluates systemic cybersecurity risk; and develops actionable recommendations to improve the organization's defensive posture.

Responsibilities

• Lead comprehensive cybersecurity assessments across complex, heterogeneous enterprise IT environments.
• Assess security architecture, controls, configurations, operational practices, and telemetry across on-premises, cloud, hybrid, and distributed environments.
• Evaluate security of enterprise networks, Windows and Linux infrastructure, endpoints, applications, databases, virtualization platforms, cloud services, identity and access management systems, network-security infrastructure, and security-management platforms.
• Lead vulnerability assessments, configuration reviews, security-control assessments, threat hunts, and defensive cyber assessments.
• Analyze complex security events and telemetry to identify sophisticated attacks, lateral movement, persistence mechanisms, privilege escalation, data exfiltration, and other adversary behaviors.
• Correlate information across SIEM, EDR/XDR, network, identity, cloud, application, vulnerability-management, and infrastructure-management platforms.
• Lead investigations of significant cybersecurity incidents and provide technical direction for containment, eradication, recovery, and lessons learned.
• Evaluate enterprise attack surfaces and identify systemic weaknesses spanning multiple systems or technology domains.
• Develop risk-based remediation strategies and prioritize findings based on mission impact, exploitability, exposure, and adversary activity.
• Lead development and improvement of cybersecurity assessment methodologies, automated assessment capabilities, detection strategies, and defensive analytics.
• Translate technical findings into actionable recommendations for government and senior technical leadership.
• Review and approve assessment plans, technical findings, reports, and remediation recommendations developed by other analysts.
• Mentor and provide technical leadership to entry- and intermediate-level analysts.
• Serve as a subject-matter expert on enterprise defensive cybersecurity, security assessment, vulnerability management, and threat detection.
• Track emerging vulnerabilities, attack techniques, adversary TTPs, and changes in enterprise technology to continuously improve assessment and defensive capabilities.

Required Qualifications

• 7+ years of experience in cybersecurity, defensive cyber operations, security engineering, information assurance, vulnerability management, or a related field.
• Demonstrated ability to lead cybersecurity assessments across diverse and complex enterprise IT environments.
• Expert knowledge of enterprise network architecture, operating systems, cloud computing, virtualization, applications, databases, identity and access management, and cybersecurity technologies.
• Demonstrated experience with SIEM, EDR/XDR, vulnerability management, network security, threat hunting, incident response, and security analytics technologies.
• Expert knowledge of NIST SP 800-53, NIST SP 800-37, RMF, STIGs, CIS benchmarks, and related cybersecurity standards and practices.
• Ability to evaluate technical and architectural risks across multiple interconnected systems and technology domains.
• Strong technical writing, briefing, analytical, and leadership skills.
• DoD 8570 IAT Level III certification required.
• Must hold Top Secret security clearance. Counterintelligence polygraph desired.