Apply on Employer Site

Booz Allen Hamilton · 1 week ago

Cyber Analytics Developer, Senior

Washington, DC

Full-time

Hybrid

Senior Level, Lead/Staff

$87K/yr - $198K/yr

10+ years exp

Booz Allen Hamilton is seeking an experienced Cyber Analytics Developer to join their Security Operations Center (SOC) team. The role involves developing custom analytics using machine learning and AI to detect advanced threats, enhancing analytics based on threat intelligence, and collaborating with analysts to improve cybersecurity measures.

ConsultingCyber SecurityIT InfrastructureManagement ConsultingSecurity

Growth Opportunities

No H1B

Security Clearance Required

U.S. Citizen Only

Responsibilities

Support the development of custom analytics using machine learning, AI, or statistical modeling to detect advanced threats and anomalies

Evaluate and enhance analytics regularly based on threat intelligence and security operations findings

Design, build, and maintain analytic content that helps detect, monitor, and respond to cybersecurity threats

Collaborate with analysts to develop meaningful analytics that can be utilized by the client

Integrate advanced analytics into threat detection processes enabling adaptive defenses and predictive threat modeling

Develop custom analytics, dashboards, and detections to identify sophisticated attack patterns targeting applications and systems

Establish a dynamic knowledge base of analytics and historical analysis, ensuring analysts have access to content for better decision-making

Be able to fine tune alerts to reduce false positives and improve accuracy

Develop adaptive incident response models using AI-powered or similar technologies for behavioral analytics and make recommendations on how to provide better predictive incident analysis

Create detection logic, playbooks, and dashboards that enable proactive threat detection

Create dashboards for SOC analysts to monitor threats in real time

Build executive-level reports on detection coverage and SOC effectiveness

Provide visibility into attack campaigns, trends, and threat actor behaviors

Help the SOC with improved threat visibility across the enterprise and reduce analyst fatigue from false positives

Work with threat and research teams to develop playbooks to automate repetitive security tasks

Create scripts such as Python, PowerShell, and SQL, to process and enrich security data

Integrate threat intel feeds such as IOCs, IOBs, and YARA rules

Translate adversary TTPs into hunt queries and detection logic

Support cyber threat hunters with enriched analytics

Qualification

Cyber analytics developmentMachine learningSIEM detection rulesData analyticsCustom dashboardsThreat modelingStatistical modelingReport writingSecurity certificationsSoft skillsCommunication skillsTeam collaborationProblem-solvingPresentation skills

Required

10+ years of experience developing cyber analytics or detection engineering

Experience with the development of custom detection rules such as queries, correlation rules, and alerts in SIEMs, including behavioral analytics based on attacker TTPs

Experience using statistical and machine learning models to spot anomalies or rare events

Experience with customizable dashboards such as Splunk and MISP, and visualization tools such as Tableau, Power BI, or AWS or Azure Cloud dashboards

Ability to perform data analytics and threat modeling by analyzing log sources such as network, endpoint, cloud, and identity, to determine what data can be used for detection

Secret clearance

Bachelor's degree and 12+ years of experience in cyber, OR 15+ years of experience in cyber in lieu of a degree

Preferred

Experience working in a SOC or cyber operations environment

Ability to write succinct briefings, presentations, and reports to convey analysis, threat trends, threat actor profiles, indicator bulletins, vulnerability details, and defensive strategies to varied audiences

CISSP, GCTH, GCTI, GCIH, CEH, OSCP, or equivalent certification