Cyber Analytics Developer, Senior

Join our Security Operations Center (SOC) team as an experienced Cyber Analytics Developer. Support the development of custom analytics using machine learning, AI, or statistical modeling to detect advanced threats and anomalies. Evaluate and enhance analytics regularly based on threat intelligence and security operations findings. Design, build, and maintain analytic content that helps detect, monitor, and respond to cybersecurity threats. Collaborate with analysts to develop meaningful analytics that can be utilized by the client. Integrate advanced analytics into threat detection processes enabling adaptive defenses and predictive threat modeling. Develop custom analytics, dashboards, and detections to identify sophisticated attack patterns targeting applications and systems.

Establish a dynamic knowledge base of analytics and historical analysis, ensuring analysts have access to content for better decision-making. Be able to fine tune alerts to reduce false positives and improve accuracy. Develop adaptive incident response models using AI-powered or similar technologies for behavioral analytics and make recommendations on how to provide better predictive incident analysis. Create detection logic, playbooks, and dashboards that enable proactive threat detection. Create dashboards for SOC analysts to monitor threats in real time. Build executive-level reports on detection coverage and SOC effectiveness.

Provide visibility into attack campaigns, trends, and threat actor behaviors. Help the SOC with improved threat visibility across the enterprise and reduce analyst fatigue from false positives. Work with threat and research teams to develop playbooks to automate repetitive security tasks. Create scripts such as Python, PowerShell, and SQL, to process and enrich security data. Integrate threat intel feeds such as IOCs, IOBs, and YARA rules. Translate adversary TTPs into hunt queries and detection logic. Support cyber threat hunters with enriched analytics.

Basic Qualifications:

• 10+ years of experience developing cyber analytics
• Experience with the development of custom detection rules such as queries, correlation rules, and alerts, in SIEMs, including behavioral analytics based on attacker TTPs
• Experience using statistical and machine learning models to spot anomalies or rare events
• Experience with customizable dashboards such as Splunk and MISP, as well as visualization tools such as Tableau, Power BI, or AWS or Azure Cloud dashboards
• Ability to perform data analytics and threat modeling by analyzing log sources such as network, endpoint, cloud, and identity, to determine what data can be used for detection
• Secret clearance
• Bachelor’s degree

Additional Qualifications:

• Experience working in a SOC or cyber operations environment
• Ability to write succinct briefings, presentations, and reports to convey analysis, threat trends, threat actor profiles, indicator bulletins, vulnerability details, and defensive strategies to varied audiences
• CISSP, GCTH, GCTI, GCIH, CEH, OSCP, or equivalent Certification

Clearance:

Applicants selected will be subject to a security investigation and may need to meet eligibility requirements for access to classified information; Secret clearance is required.

Compensation:

At Booz Allen, we celebrate your contributions, provide you with opportunities and choices, and support your total well-being. Our offerings include health, life, disability, financial, and retirement benefits, as well as paid leave, professional development, tuition assistance, work-life programs, and dependent care.

The projected compensation range for this position is $86,800.00 to $198,000.00 (annualized USD).

Commitment to Non-Discrimination:

All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local, or international law.