Cyber Threat Emulation & Analyst

Position Overview

STS Systems Support, LLC (SSS) is seeking a Cyber Threat Emulation & Analyst at Lackland AFB in San Antonio, TX.

Required Qualifications

• DoDD 8570.01‐M/8140.01 I AT Level III CND
• Active TS/SCI
• Five years' of penetration testing experience. BA/BS or MA/MS
• Five (5) years of penetration testing experience.
• Demonstrated advanced knowledge of cyber security operations with mastery of two or more of the following: attack surface management, Security Operations Center (SOC) operations, Intrusion Detection/Intrusion Prevention Systems (IDS/IPS), Security Information and Event Management (SIEM) use, threats (including Advanced Persistent Threat (APT), insider), vulnerabilities, and exploits; incident response, investigations and remediation.
• Experience with PowerShell, BASH or Python scripting/programming language.
• Must have a strong understanding of Linux Operating System.
• Extensive knowledge of MITRE ATT&CK framework, and its uses within the cybersecurity community (e.g., Open Source projects)

Key Responsibilities

• Conduct both automated and manual enterprise vulnerability assessments, including regular patch & configuration vulnerability assessments as directed by operational flight leads.
• Conduct Cyber Threat Emulation operations and coordinate with security teams to strengthen the overall security posture of the AFNet and AFIN tools and capabilities.
• Test for real‑time security vulnerabilities, perform assessments, and evaluate vulnerability risk and impact.
• Continuously develop and maintain safe and valid procedures to actively test Enterprise defensive measures. (CDRL A007 & A008)
• Develop mitigations, policies, and procedures to coordinate with internal teams. (CDRL A007)
• Collaborate with the incident response team to develop response policies and procedures.
• Generate threat intelligence indicators during Cyber Threat Emulation operations and provide reports back to operators. (CDRL A008)
• Coordinate with internal and external intelligence teams to replicate threat actor (TA) Techniques, Tactics, and Procedures (TTPs).
• Research and evaluate threats and vulnerabilities to assist in prioritizing remediation actions.
• Utilize knowledge of the Cyber Threat Framework (ODNI) in producing Threat Emulation findings.
• Apply the MITRE ATT&CK framework to perform cybersecurity operations testing and develop improvements based on adversary behavior.
• Formulate, lead, and persuade individuals, large teams, and communities on ideas, concepts, and opportunities.
• Leverage research, frameworks, and best practices on the latest exploits and cybersecurity trends to produce operational reports and assessments for developing tactics, techniques, and procedures. (CDRL A002)
• Provide on-the-job training to contractor employees, military, and/or civilian personnel, ensuring continuity folders and working aids are updated quarterly to facilitate smooth transitions.
• Create, document, and report metrics for analysis to improve weapon system processes and mission execution. (CDRL A009)
• Provide information to operational leadership related to CTE actions as required.

Benefits & Perks

• Competitive benefits package including paid holidays.
• Paid Time Off, including sick and vacation leave.
• Medical, Dental, and Vision Insurance.
• Flexible spending accounts, short and long term disability, company paid life insurance, 401(k) with a company match, discretionary profit sharing, and tuition reimbursement.

STS Systems Support, LLC (SSS) is an Equal Opportunity Employer. Employment decisions are made without regard to any protected category. Hiring preference will be given to BBNC shareholders, their spouses and descendants, and Alaska Natives in accordance with Public Law 93-638.