Central Strategies is seeking an experienced Content Developer to join our team on a highly visible cybersecurity single-award IDIQ vehicle. Duties include proactively searching for threats, inspecting traffic for anomalies and new malware patterns, and investigating and analyzing logs. The candidate will develop custom content within the Splunk SIEM using advanced SPL language and data models, as well as other network security tools, to detect threats and attacks against the enterprise. SIEM Content Developers participate in briefings to provide expert guidance on emerging threats and act as an escalation point for analysts. The role may also require authoring reports and interfacing with customers for ad-hoc requests. In addition, the candidate will contribute recommendations to improve SOC visibility and processes.
Primary Responsibilities:- Capture use cases from subscribers or team members and develop correlation rules
- Utilize knowledge of current threats and attack vectors to develop Splunk correlation rules for continuous monitoring
- Develop, manage, and maintain Splunk data models
- Review logs to ensure relevant data is available for use case development
- Develop custom regex to create knowledge objects
- Create advanced SPL using macros, lookups, and other techniques, along with network security signatures (SNORT, YARA)
- Build custom dashboards and reports for stakeholders
- Train and mentor junior staff
Basic Qualifications:- Active Top Secret/SCI Clearance
- Bachelor's degree + 12 years (or Master's + 10 years) in a relevant field
- Minimum 8 years of experience in incident detection/response, malware analysis, or cyber forensics
- Strong experience with cybersecurity methodologies and SOC processes
- Advanced knowledge of TCP/IP and large-scale log analysis across heterogeneous systems
- Expertise in at least two areas: vulnerability assessment, IDS/IPS, access control, policy enforcement, application security, protocol analysis, firewall management, incident response, web filtering, or advanced threat protection
- Experience developing advanced correlation rules using tstats and data models
- Strong experience with Splunk knowledge objects and data models
Preferred Qualifications:- Cloud security monitoring experience (O365, Azure, AWS)
- Splunk Advanced Searching & Reporting training
- Splunk certifications
