Watch Analyst

Peraton is currently seeking to hire a Watch Analyst for its' Federal Strategic Cyber group.

Location: Arlington, VA (On-site) 

This position is part of the DHS Cybersecurity Infrastructure Security Agency’s (CISA) 24/7 SCIF/Operations Center, which is the hub for staying on top of threats and emerging risks to our nation’s critical infrastructure. Through this operation center, the federal government coordinates situational awareness and response to protect national cyber and infrastructure security.

Position Description:

• The Watch Officer coordinates cyber and physical incidents affecting critical infrastructure and produces various levels of incident reporting. Watch Officers gather information from multiple sources and varying levels of classification to provide accurate, timely, and actionable information to our government leadership, law enforcement, federal stakeholders and partners.
• The Watch Officer candidate should be an experienced Operations/Intelligence/Cyber practitioner with the ability to work in a time sensitive detailed orientated operational environment, conduct quick assessments of cyber related events, and brief senior leaders in a timely manner.
• The Watch Officer candidate will possess the ability to effectively manage cyber and physical incidents in collaboration with federal staff.
• In addition, the Watch Officer is responsible for leading a team of several analysts throughout the shift and coordinating all tasks through completion.
• The Watch Officer candidate will triage, analyze, and coordinate cyber, communications, and physical incidents to identify the severity of impact to critical infrastructure. Watch Officer’s help determine the level of reporting or briefing required, coordinates incident operational data collection and analysis, and monitors the event through competition.
• Watch Officer must be prepared to communicate on multiple platforms and brief management and senior leadership on developing situations during daily briefings or on an ad hoc basis.
• Understand the operation of all communications and information technology hardware, software, and firmware utilized to perform daily functions. The candidate should have the ability to troubleshoot all equipment issues as needed and coordinate a resolution with the help desk.
• Monitors classified databases, the ticket management system, subscription-based alerting services, cable and local news, social media, and other open source for threats to the nation’s critical infrastructure and global operations impacting national security.
• Watch Officer will act as liaisons with internal divisions, federal stakeholders, law enforcement, intelligence agencies, regional personnel, industry partners, and internal partners to ensure coordinated reporting for events that have cascading cross-sector impacts to critical infrastructure.
• Watch Officer must be able to multitask, make quick decisions, and utilize critical thinking skills in a fast paced and time sensitive environment under the direction of a federal CISA Duty Officer.
• Must have the ability to read technical cyber reporting and be able to extract the important information to provide clear and concise reporting for a non-technical audience.
• Utilize proprietary processes and technologies to support enterprise-wide international security and crisis management programs.
• Other services and support as needed or directed by the government client.
• The Watch Officer candidate will work at a 24x7x365 Classified Operations and Watch Center.
• • Shifts are assigned based on the needs of the team and may include rotating assignments.
    • Shift 1: M-F 0600 - 1400
    • Shift 2: M-F 1400 - 2200
    • Shift 3: M-F 2200 - 0600
    • Shift 4: Sat/Sun 0600 – 1800 and two 8-hour weekday shifts
    • Shift 5: Sat/Sun 1800 – 0600 and two 8-hour weekday shifts

#CISA

Basic Qualifications:

• Bachelor’s degree with a minimum of 2 years related technical experience, or a Master's degree with 0 years of related experience. 6 years of relevant experience may be substituted in lieu of a degree.
• Experience with crisis management at the national and local level.
• Experience with utilizing work instructions and templates.
• Experience with time sensitive report writing.
• Demonstrated ability to manage the production and publishing of event driven reporting, cyclic reporting, and briefing products.
• Demonstrated ability to manage cyber related incidents while multitasking and performing steady states shift functions.
• Demonstrated ability to manage and triage group email accounts.
• Demonstrated ability to communicate professionally via email in a timely manner.
• Demonstrated ability to conduct oral senior leader briefings.
• Must be flexible and able to work within a 24x7x365 operations support environment. 
• Experience with open-source analysis and alerting systems.
• Knowledge of Microsoft Office automation solutions.
• Experience with Remedy Service, Knowledge Management System, and ServiceNOW or other Service Desk ticketing system.
• Have the ability to obtain a TS/SCI for continued employment.
• In addition, selected candidate must be able to obtain and maintain a favorably adjudicated DHS background investigation for continued employment.

Preferred Qualifications:

• Experience as an Operations Officer/Action Officer/Incident Manager.
• Experience in drafting and publishing national level reporting.
• Experience with email triage and requests for information (RFIs).
• Experience as an All-Source Intelligence Analyst in Joint Operations Center and/or Fusion Center.
• Experience as a national level briefer for senior leadership.
• Experience with cyber incident management and analysis.
• Obtained Cyber certifications (i.e., CompTIA Security+).
• Top Secret security clearance.