Deloitte US

The Cyber Analyst team member is responsible for the analysis of all technology devices which will include Operational Technology (OT) and Industrial Control Systems (ICS) with-in enterprise. This includes analytical analysis of device communication, forensic analysis of Windows or Linux systems and servers, timeline analysis of activity on these endpoints, user permission and authentication audits, log analysis, and malware identification/triage. As journeyman the role may also encompasses the development and engineering of legacy, current, or emerging solutions.
An ideal candidate for this position will be a proactive worker who has experience not only with system or network administration, but also with the nuances of OT, ICS and Building Automation Services (BAS). Proficiency in Windows and Linux operating systems (OS) mechanics and filesystem structures, disk and memory forensics, and commonly abused tools/vectors for persistence, privilege escalation, and lateral movement are crucial. In the context of OT and ICS, understanding operating system log analysis and triaging suspicious file artifacts for unusual behavior with a good understanding on how controls systems manage and operate infrastructure supporting functions like water, power, energy, manufacturing, and other critical services.
This role requires a familiarity with what routine OS activities and common software/user behavior look like in the context of forensic artifacts or timelines, particularly in OT and ICS environments. Analysts should also be familiar with common categories and formats of host-based indicators of compromise (IOCs) and how/where they can be leveraged to identify known-bad files/activity on an endpoint. This includes understanding the specific challenges and threats associated with OT and ICS systems.
The candidate will utilize the Cyber Kill Chain to synthesize the entire attack life cycle, including potential impacts on OT and ICS systems. They should be capable of creating detailed reports on how impacts may or have occurred, especially in relation to OT and ICS, as well as proposing preventive measures for these specific

Work you’ll do 

• The selected candidate will have several responsibilities from day to day drawn from a wide array of activities and experience working in the following areas:
• Validating and verifying system security requirements and establishing system security designs for systems, major system elements, and interfacing systems that are part of a network environment with geographically distributed components.
• Identifying and implementing appropriate information security architectures and functionality to ensure uniform application of security policy and enterprise solutions.
• Recommending and developing technical solutions, products, and standards based on current and desired system security architecture.
• Communicating with Program Managers and POCs from customer organizations when necessary, regarding Security issues of significant importance.
• Analyzing and assessing system implementation against multiple security compliance policies and recommending and implementing enhancements
• Administration of multiple systems of different architectures (Windows, Linux, Mac, etc)
• Supporting risk assessment, risk management, security control assessment, continuous monitoring, service design, and other Information Assurance (IA) program support functions.

Qualifications

Required:

• Must have an active Secret Clearance to be considered
• Bachelor’s Degree in IT/Cybersecurity related field
• At least 3 years, (Junior level) applicable 1 to 2 years of experience in security operations or industrial control automation/management and demonstrating analytical duties and preforming host or network security analysis
• Support SOC team in operating and preforming duties in a Security Operations Center (SOC) to provide a secure environment that facilitates incident response and threat hunting activities.
• Build and create a test bed of Operational Technology (OT) Industrial Control Systems (ICS)
• Engineer future solutions, network enhancements, and system infrastructures
• Manage the SIEM platform to monitor for security alerts and coordinate vulnerability assessments and artifact collection across servers and network devices
• Evaluate network structures and device configurations for security risks, offering recommendations based on best practices, and gather data to identify and respond to network intrusions
• Analyze network traffic and system logs to identify malicious activities, vulnerabilities exploited, and methods used, and develop processes to enhance SOC response and efficiency
• Conduct comprehensive technical analyses of computer evidence, research and integrate new security tools into the SOC, and synthesize findings into reports for both technical and non-technical audiences