Cybersecurity Blue Team Analyst – Senior

Minimum Qualifications: The Senior Cybersecurity Blue Team Analyst serves as a technical authority for cybersecurity assessment and defensive cyber operations across complex enterprise IT environments. The analyst leads assessments of infrastructure, applications, networks, cloud environments, security architectures, and enterprise services; evaluates systemic cybersecurity risk; and develops actionable recommendations to improve the organization's defensive posture.

Responsibilities: Lead comprehensive cybersecurity assessments across complex, heterogeneous enterprise IT environments. Assess security architecture, controls, configurations, operational practices, and telemetry across on-premises, cloud, hybrid, and distributed environments. Evaluate security of enterprise networks, Windows and Linux infrastructure, endpoints, applications, databases, virtualization platforms, cloud services, identity and access management systems, network-security infrastructure, and security-management platforms. Lead vulnerability assessments, configuration reviews, security-control assessments, threat hunts, and defensive cyber assessments. Analyze complex security events and telemetry to identify sophisticated attacks, lateral movement, persistence mechanisms, privilege escalation, data exfiltration, and other adversary behaviors. Correlate information across SIEM, EDR/XDR, network, identity, cloud, application, vulnerability-management, and infrastructure-management platforms. Lead investigations of significant cybersecurity incidents and provide technical direction for containment, eradication, recovery, and lessons learned. Evaluate enterprise attack surfaces and identify systemic weaknesses spanning multiple systems or technology domains. Develop risk-based remediation strategies and prioritize findings based on mission impact, exploitability, exposure, and adversary activity. Lead development and improvement of cybersecurity assessment methodologies, automated assessment capabilities, detection strategies, and defensive analytics. Translate technical findings into actionable recommendations for government and senior technical leadership. Review and approve assessment plans, technical findings, reports, and remediation recommendations developed by other analysts. Mentor and provide technical leadership to entry- and intermediate-level analysts. Serve as a subject-matter expert on enterprise defensive cybersecurity, security assessment, vulnerability management, and threat detection. Track emerging vulnerabilities, attack techniques, adversary TTPs, and changes in enterprise technology to continuously improve assessment and defensive capabilities.

Required Qualifications: 7+ years of experiencein cybersecurity, defensive cyber operations, security engineering, information assurance, vulnerability management, or a related field. Demonstrated ability to lead cybersecurity assessments across diverse and complex enterprise IT environments. Expert knowledge of enterprise network architecture, operating systems, cloud computing, virtualization, applications, databases, identity and access management, and cybersecurity technologies. Demonstrated experience with SIEM, EDR/XDR, vulnerability management, network security, threat hunting, incident response, and security analytics technologies. Expert knowledge of NIST SP 800-53, NIST SP 800-37, RMF, STIGs, CIS benchmarks, and related cybersecurity standards and practices. Ability to evaluate technical and architectural risks across multiple interconnected systems and technology domains. Strong technical writing, briefing, analytical, and leadership skills. Must hold Top Secret security clearance. Counterintelligence polygraph desired.