Cyber Forensics amp Malware Analysis Lead

Profile

SAIC has an opportunity for a Lead Cyber Forensics and Malware Analyst to support the US Army Corps of Engineers Revolutionary IT Services (USACE RITS) program.
This is a 100% virtual / work from home / remote position located anywhere in the CONUS.
The USACE RITS contract will provide modern and secure enterprise-wide IT support services to approximately 37,000 USACE customers located throughout the CONUS and OCONUS. Services will support the mission needs of USACE’s  Headquarters (HQs) located in Washington, D.C., nine Divisions and 43 Districts, to include over 1,500 field and area project offices and two data centers that are currently located in Vicksburg, Mississippi, and Hillsboro, Oregon.
The ideal candidate will support USACE OCIO/G-6 Cyber Forensics and Malware Analysis (CF&MA) efforts in both cloud and on premise environments.
The ideal candidate will have the knowledge, skills, and leadership capabilities to manage a team that supports USACE in the areas of file data collection, volatile data collection, system anomalies analysis, malware reverse engineering, and creation of indicators of compromise (IOC) to improve the protection of USACE information. USACE CF&MA works in concert with the Army Cyberspace Operations and Integration Center (ACOIC) and ARCYBER to ensure electronic evidence collection and integrity are maintained throughout the lifecycle of the evidence.
The ideal candidate will need to know how to lead a CF&MA team that:
Performs forensically sound electronic data collections, analysis and reverse engineering of malware, suspect code, email, malformed program objects, and volatile memory in accordance with USACE OCIO/G-6 directives, and chain of custody guides utilizing industry best practices.
Analyzes the attack/exploit capability of malware as directed by USACE OCIO/G-6.
Provides all pertinent findings and IOCs to teams responsible for the development of signatures to detect the malware as it propagates on infected systems.
Collets, preserves, and transfers forensic evidence of unauthorized access to CorpsNet devices or information systems in accordance with USACE OCIO/G-6 policy and processes.
Produces analysis reports for each incident and provides them to USACE OCIO/G-6.
Works and interacts with professionals, internal and external to USACE, to understand higher-level adversary capability.
Documents, updates, and enhances processes and procedures by producing training materials, tools, tactics, techniques, procedures, SOPs, lessons learned, and reports.
Qualifications
Education/Experience:
Bachelors( four years experience in lieu of degree) and nine (9) years or more experience; Masters and seven (7) years or more experience; PhD or JD and four (4) years or more experience along with;
Five (5) or more years of experience in reverse engineering malware.
Strong software development skills
Strong understanding of networking concepts
Ability to develop scripts using Python, Powershell, Bash, JavaScript or other scripting languages
Familiar with Perl, .NET, or Java
Understanding of Windows Internals to include: APIs, processes/threads, memory management
Understanding of the Portable Executable (PE) format, and parsing of non-standard text file formats
Experience with debugging
Familiarization with VMWare Workstation, Network, and SysInternal tools
Skill set in Windows system programming, kernel debugging, driver development and/or IDA Python
Able to analyze disassembly of x86 and x64 binaries
Code reverse engineering or malware analysis skills
Experience with static analysis of malware
Familiarization with Linux OS
Experience with Sandboxes
Excellent writing and communication skills
Leading CF&MA for United States federal or DOD organizations with a proven track record of high achievement.  You will be expected to know TTPs and tools for performing C&MA for the interview.
Preferred experience:
Eight (8) or more years of experience in reverse engineering malware.
Demonstrated experience programming in x86 Assembly, C/C /C#, Perl, .NET, or Java
CERTIFICATIONS:
Current IAT-III certification
(CASP CE, CCNP Security, CISA, CISSP (or Associate), GCED, or GCIH)
AND
Current Cyber Security Service Provider-Analyst (CSSP-A) certification:
(CEH, CFR, CCNA Cyber Ops, CCNA-Security, CySA , GCIA, GCIH, GICSP, Cloud , SCYBER, or PenTest )
GIAC certifications, to include GIAC Reverse Engineering Malware (GREM), are highly desired.
LEADERSHIP AND MANAGEMENT:
A minimum of three (3) years of experience leading and managing teams of no less than three (3) personnel.
CLEARANCE REQUIREMENT:
Must have or be able to obtain a Secret clearance
COVID Policy: Prospective and/or new employees are required to adhere with SAIC's vaccination policy. All SAIC employees must be fully vaccinated and they must submit proof of vaccination on their first day of employment. Prospective or new employees may seek an exemption to the vaccination requirement at ****,000. The estimate displayed represents the typical salary range for this position based on experience and other factors.


Overview
SAIC® is a premier Fortune 500® technology integrator driving our nation's technology transformation. Our robust portfolio of offerings across the defense, space, civilian, and intelligence markets includes secure high-end solutions in engineering, digital, artificial intelligence, and mission solutions. Using our expertise and understanding of existing and emerging technologies, we integrate the best components from our own portfolio and our partner ecosystem to deliver innovative, effective, and efficient solutions that are critical to achieving our customers' missions.

We are more than 26,500 strong; driven by mission, united by purpose, and inspired by opportunities. SAIC is an Equal Opportunity Employer, fostering a respectful work culture based on diversity, equity, and inclusion that values all contributors. Headquartered in Reston, Virginia, SAIC has annual revenues of approximately $7.1 billion. For more information, visit saic.com.
Share:
mail
Categories
Information Technology
Engineering
Posted:
2022-03-01
Expires:
2022-03-31
SAIC

Company info

Sign Up Now - WashingtondcCrossing.com