Secure Division Support. The GCC provides CSSP responsibilities and conducts DODIN Operations and DCO – Internal Defensive Measures (IDM) to protect the DODIN IAW the DoDM 8530.01 and the DoD Cybersecurity Services Evaluator Scoring Metrics (ESM). These responsibilities are broken into five (5) CSSP functions; Identify, Protect, Detect, Respond, and Recover. GCC is responsible to conduct these functions for its assigned portion of the DODIN for both unclassified and classified networks/ systems. The division provides support services for the protection, monitoring, analysis, detection, and response to unauthorized activity within the DoD Information Systems and Networks. DCO-IDM services are required to defend against unauthorized activity on all Army assets residing on the NIPRNet and SIPRNet. The division provides defensive measures to protect and defend information, computers, and networks from disruption, denial, degradation, or destruction. The division provides sensor management and event analysis and response for network and host-based events. For sensor management, the division provides management of in-line Network Intrusion Protection System/Network Intrusion Detection System (NIPS/NIDS) sensors monitoring all CONUS DoDIN-A NIPRNet and SIPRNet Enterprise traffic to detect sensor outages and activities that attempt to compromise the confidentiality, integrity, or availability of the network. In coordination with GCC Operations, DCO initiates defensive security procedures upon detection of these attacks. Event analysis and response includes the processes involved with reducing multiple cyber incidents to actual malicious threat determinations and mitigating those threats IAW guidance received from GCC Government leadership. Support the Government in providing services for CSSP services on both the NIPRNet and SIPRNet IAW Appendix E: Secure Division Workload Assessment in support of the CONUS portion of the DoDIN-A. Develop reports and products, both current and long-term, in support of CSSP and course of action development. Prepare Tactics, Techniques, and Procedures (TTP), SOPs, Executive Summary (EXSUMS), trip reports, and information/point papers. Contribute during the preparation of agreements, policy, and guidance documentation such as Memorandums of Understanding / Agreement (MOU/A), Service Level Agreements (SLA).
• Cyber Defense Operations (CDO) Support. Provide sufficient staffing to maintain on-site capability IAW PWS paragraph 5.4: Place of Work and Work Hours to work directly with GCC Operations personnel in conducting initial triage/cyber incident analysis to include, review correlated events, system/device logs, and SIEM event data to determine and recommend/take immediate DCO-IDM response actions. Immediate response actions can include submission of a cyber-incident response ticket, making an initial determined category of cyber incident (IAW Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510), and/or notifying DCO/ARCYBER/Higher Headquarters IAW Commander’s Critical Information Requirements (CCIR) reporting requirements. All other CDO operations must have an on-call capability to take actions as required to respond to cyber incidents IAW policy and/or Government direction.
• Incident Analysis and Mitigation. Provide incident analysis and mitigation support by conducting incident analysis and recommending mitigation measures in response to general or specific Advanced Persistent Threats (APT), (attempted exploits/attacks, malware delivery, etc.) on Army networks. In support of incident analysis and mitigation, the Contractor shall:
• Block/deny access by hostile sites or restrict access by specific ports/protocols and/or applications.
• Provide recommendations to the supporting operations and maintenance organization to take necessary action where the CSSP-D Division does not administratively control the sensor grid.
• Provide justification of IDMs and/or operational impact (implied or accepted risk) to a Configuration Control Board (CCB) and/or Authorizing Official (AO), as required, for mitigation action (IDM) approval. If deemed appropriate (or as requested), the internal defensive measure may involve coordination of a Network Damage Assessment (NDA), Network Assistance Visit (NAVs), or other version of the Computer Defense Assistance Program (CDAP) mission.
• Monitor all sensors and agents managed by the GCC for security event analysis and response and maintain/update the triage database with current threat data and response methods in real-time with follow-up recurring within 72 hours of last response. The Contractor shall respond to a detected event and perform triage, ensure proper handling of the associated trouble ticket (TT), and process events accordance with appropriate TTPs.
• Provide all initial cyber incident reports to Law Enforcement and Counterintelligence (LE/CI) agencies and:
• Maintain an up-to-date POC list for LE/CI agencies as routinely provided by the Major Cybercrimes Unit (MCU) and Cyber Counterintelligence agencies.
• In cases where an active investigation will be opened, LE/CI agencies will provide written request that will include the official case number, specific data logs, and other required information IAW local TTPs.
• Provide support and expertise include the provision of the required data along with a summary or analysis of the data. Data and answers provided in the analysis shall pertain specifically to requirements in the LE/CI official request or within CSSP-D TTPs.
• Provide all initial cyber incident investigation reports to LE/CI .
• Maintain a Master Station Log (MSL) to document high visibility cyber incidents, defined as events identified in an ARCYBER Task Order, a Named Operation, or a Category 1 (CAT1), with status, discuss DCO topics, share internal tasks between shifts, document call outs, and share any additional relevant instructions between shifts and up through GCC Leadership and Operations reporting channels. The MSL must be available for Government inspection at any given time to ensure accurate tracking of the above information.
Basic Qualifications:
Target Salary Range: $80,000 - $128,000. This represents the typical salary range for this position based on experience and other factors.
EEO: Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.
Our client, a leader in data quality solutions, is seeking a Data Annotation Specialist to join their team. As a Data Annotation Specialist, you will be part of the Data Quality Team supporting various annotation projects. The ideal candidate will have excellent communication...
The Pharmacists at Mission Community Hospital is responsible for providing optimal pharmaceutical care through accurate and efficient dispensing, assuring compliance with all state and federal regulation, laws, and standards. The Pharmacist PD plays a key role in providing...
Class A Local HAZMAT Truck Driver for Auto Store Deliveries JobHome daily, Monday-Friday starting between 0600-0800 AM. Average 10-12 hrs/day. Deliver... .... Create a Driver's Account.Person to Contact about this CDL Job: Miranda DemosTransforce, Inc Phone Number: 614-835-51...
...Albemarle, NC. Broad River Rehab is a rapidly growing, NC based therapy company that partners with providers across all settings... ...assisted living and skilled nursing facilities to provide premier physical, occupational and speech therapy services. Requirements for...
**The opportunity**Delaware North Gaming is hiring full-time Barbacks to join our team at Southland Casino in West Memphis, Arkansas. As a Barback, you will track and stock inventory, deliver beverages, and provide excellent guest service and support to your team.Please...