DAE/SI Cyber Threat Analyst

• Tier One Technologies is looking for a Detection & Automation Engineering (DAE) / Super Intelligence (SI) Cyber Threat Analyst to work with our direct US Government client.
• This semi-remote Contract-to-Hire position can start in Falls Church, VA, Raleigh, NC or Eagan, MN.
• SELECTED CANDIDATES WITHOUT REQUIRED CLEARANCE WILL BE SUBJECT TO A FEDERAL GOVERNMENT BACKGROUND INVESTIGATION TO RECEIVE IT.

• Support CISO Operations in designing, implementing, and maintaining automated/Super Intelligence security detection, integration capabilities across enterprise security monitoring technologies.
• Improve threat detection and response through detection engineering, security automation, systems integration, data analysis, super intelligent and continuous improvement of detection content and workflows.
• Collaborate closely with security operations, threat intelligence, and incident response stakeholders, along with strong documentation and operationalization practices.

• Build automation/SI and integration workflows to improve detection and response.
• Integrate and optimize security technologies (e.g., SIEM, EDR, SOAR, threat intelligence) into a cohesive detection architecture.
• Perform requirements analysis and translate operational security needs into technical specifications and implementable solutions.
• Execute testing, evaluation, and validation of detections and automation/SI workflows; drive continuous improvements based on results and operational feedback.
• Analyze telemetry to identify anomalies, trends, and detection gaps; recommend and implement detection enhancements.
• Create and maintain technical documentation, SOPs, and runbooks to support reliable operations.
• Work closely with SOC, threat intelligence, and incident response teams to align detections to threat priorities and operational processes.
• Research and assess new security and SI/ML capabilities to enhance detection effectiveness.

• A degree from an accredited College/University in the applicable field of services is required. If an individual's degree is not in the applicable field, then 4 additional years of related experience is required.
• 8+ years of experience with cyber security operations, threat hunting, and incident response.

Essential Technical Knowledge Areas (plus important/beneficial

• SOAR Tools: SentinelOne, SentinelOne Hyperautomation, Splunk Enterprise Security, Splunk SOAR
• Super Intelligence (SI) Security
• SOC operations and processes
• Threat intelligence lifecycle and analysis
• Incident response methodologies
• Network protocols and architecture
• Operating systems (Windows/Linux/Unix)
• Cloud platforms (AWS/Azure/GCP)
• Security architecture and design
• Programming/scripting (Python, PowerShell, Bash)
• API integration and development
• Detection engineering methodologies
• Security automation and orchestration concepts

Frameworks, Standards & Compliance Expectations
•    NIST SP 800-53 Security Controls
•    CIS Controls
•    MITRE ATT&CK Framework

Important/beneficial
•    CISA NICE Framework
•    ISO 27001/27002
•    FISMA
•    FedRAMP
•    OMB Circulars and Federal Cybersecurity Directives
•    Privacy Act
•    Malware analysis
•    Digital forensics procedures
•    Risk assessment methodologies
•    Machine learning and SI for security

Certifications

(One or more required): CISSP or CISA or CISM or GIAC or RHCE.

• Excellent oral and written communication skills.
• Must be able to obtain a Position of Public Trust Clearance.
• All candidates must be a US Citizen or have permanent residence status (Green Card).
• Candidate must have lived in the United States for the past 5 years.
• Cannot have more than 6 months travel outside the United States within the last 5 years. Military Service excluded.