Cyber Incident Handler

Location: Fort Huachuca

About Peraton
Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world's leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace.

The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees solve the most daunting challenges that our customers face. Visit to learn how we're keeping people around the world safe and secure.

Program Overview

About The Role
Secure Division Support. The GCC provides CSSP responsibilities and conducts DODIN Operations and DCO - Internal Defensive Measures (IDM) to protect the DODIN IAW the DoDM 8530.01 and the DoD Cybersecurity Services Evaluator Scoring Metrics (ESM). These responsibilities are broken into five (5) CSSP functions;
Identify, Protect, Detect, Respond, and Recover. GCC is responsible to conduct these functions for its assigned portion of the DODIN for both unclassified and classified networks/ systems.

The division provides support services for the protection, monitoring, analysis, detection, and response to unauthorized activity within the DoD Information Systems and Networks.

DCO-IDM services are required to defend against unauthorized activity on all Army assets residing on the NIPRNet and SIPRNet.

The division provides defensive measures to protect and defend information, computers, and networks from disruption, denial, degradation, or destruction.

The division provides sensor management and event analysis and response for network and host-based events. For sensor management, the division provides management of in-line Network Intrusion Protection System/Network Intrusion Detection System (NIPS/NIDS) sensors monitoring all CONUS DoDIN-A NIPRNet and SIPRNet Enterprise traffic to detect sensor outages and activities that attempt to compromise the confidentiality, integrity, or availability of the network. In coordination with GCC Operations, DCO initiates defensive security procedures upon detection of these attacks.

Event analysis and response include the processes involved with reducing multiple cyber incidents to actual malicious threat determinations and mitigating those threats IAW guidance received from GCC Government leadership. Support the Government in providing services for CSSP services on both the NIPRNet and SIPRNet IAW Appendix E:
Secure Division Workload Assessment in support of the CONUS portion of the DoDIN-A. Develop reports and products, both current and long-term, in support of CSSP and course of action development. Prepare Tactics, Techniques, and Procedures (TTP), SOPs, Executive Summary (EXSUMS), trip reports, and information/point papers. Contribute during the preparation of agreements, policy, and guidance documentation such as Memorandums of Understanding / Agreement (MOU/A), Service Level Agreements (SLA).

• Threat and Data Analysis. Perform the following threat and data analysis functions:

• Analyze, correlate, and trend anomalous cyber events and incidents: analyze and correlate anomalous events identified in, SIEM systems, Big Data Analytics, and supporting devices/applications. The GCC SIEM ingests feeds from over 21 different connectors to include items such as NIPS sensors, NIDS sensors, and Primary Internet Exchange (PIX) Firewall, proxy, router, policy Orchestrator (ePO) servers, and server system logs, Active Directory, Domain Name Service (DNS), etc.,

generating over 800 events per second (eps) or over 50 million events per day.

• Conduct open-source research to identify commercial exploits or vulnerabilities (i.e. Zero - Day) requiring CSSP actions. The Contractor shall identify current Army detection capabilities (Host Base Security System (HBSS), IDS/IPS, etc.) for new or potential threat activity.

• Report and facilitate the correction of issues…