Apply on Employer Site

Telos Corporation · 1 month ago

Incident Response Associate Principal

Tysons, VA 22102 US (Primary)

Full-time

Onsite

Lead/Staff

10+ years exp

Telos Corporation is a trusted provider of security solutions for IT assets. The Incident Response Associate Principal will work closely with a commercial company’s security team to develop and implement effective security monitoring and incident response strategies.

Cloud SecurityCyber SecurityEnterprise SoftwareInformation TechnologyNetwork SecuritySoftware

Work & Life Balance

No H1B

Security Clearance Required

U.S. Citizen Only

Responsibilities

Work with the customer to establish a mature Insider threat monitoring capability across multiple windows, Linux, and container environments

Execute a dual mandate over a designated time period to: Develop detection logic in the customer SIEM solution. Support the migration of logic, queries, and visualizations into a new SIEM solution

Work with the customer to improve incident response efficiencies

Support the Tier 1 Security Operations Team with investigations and responses

Improve the customer’s ability for early detection and mitigation of risks

Qualification

TS/SCI clearanceSIEM solutionsLog telemetry structureCloud service providersQuery language proficiencyDashboard creationOSINT frameworkBachelor’s degree

Required

This position requires an active TS/SCI clearance with polygraph required

Bachelor's degree in computer science, Engineering, Information Assurance, or a related discipline and 10+ years of related experience. Additional experience may be substituted for a degree

Must have experience and expertise with SIEM solutions such as Splunk, Kabana, etc

Must have experience with log telemetry structure and log logic in Windows, Linux, and Containerized environments

Experience with migrating schema mappings from one SIEM solution to another

The ability to demonstrate query language proficiencies

Must have experience with cloud service providers i.e., Google, AWS, Azure, etc

Have experience with the deployment and configuration of data collections from various system components that include operating systems, networking devices, and containerization platforms

Experience creating dashboards, analytics, and alerts within SIEM tools

Experience working with monitoring systems supporting auditing, incident response, and system health

Experience with the OSINT framework and related tools

The successful candidate must meet eligibility requirements to access sensitive information, which requires US citizenship