Mid-Level Cyber Threat Emulation Analyst

Position Overview

The Mid-Level Cyber Threat Emulation Analyst will support the Missile Defense Agency (MDA) on the Integrated Research and Development for Enterprise Solutions (IRES) contract. This role is based at Schriever Space Force Base, Colorado Springs, CO or Redstone Arsenal, Huntsville, AL. It is an in-person, full-time position with a Day shift and requires travel up to 10% of the time. Remote work is not available and applicants must have an active clearance (DoD Secret). Compensation: $120,000.00 - $132,000.00 per year.

Key Responsibilities

• Perform Defensive Cyber Operations (DCO) and Cyber Security Service Provider (CSSP) duties as outlined in Evaluator Scoring Metrics (ESM).
• Execute cybersecurity tasks on customer networks, both proactively and reactively, to enhance enterprise-wide security posture.
• Analyze threat, vulnerability, and asset data against known adversary exploits to assess impact and strengthen defenses.
• Support the development, review, and update of DCO procedures, manuals, and related documentation.
• Measure the effectiveness of defense-in-depth architecture against vulnerabilities and generate vulnerability assessment reports.
• Support Incident Response across the enterprise in accordance with DoD regulations.
• Lead cyber event and incident investigations, including data gathering, analysis, and reporting.
• Mentor and instruct junior, mid, and senior analysts as part of developing an Exploitation Analyst training plan.
• Review and implement Higher Headquarters Tasking Orders (HHQ) and Fragmentary Orders on a weekly basis.
• Perform Cyber Threat Emulation (CTE) activities using an Automated Security Validation toolset and execute actions within approved network zones.
• Create custom dashboards and reports detailing engagement analysis, identified vulnerabilities, and recommended remediation steps.
• Draft and submit Cyber Tasking Orders (CTOs) to address issues identified during CTE engagements.
• Collaborate with the Cyberspace Domain Awareness (CDA) team to develop evaluation criteria and methodologies aligned with inspection requirements and industry best practices.

Required Qualifications

• At least 6 years of full-time work experience.
• Minimum of 4 years of combined experience in:
  • Performing manual or automated penetration tests in an enterprise environment
  • Conducting vulnerability assessments, understanding cybersecurity frameworks, or risk assessments
  • Managing the full life cycle of incident response and enterprise-level monitoring
• At least 1 year of management or leadership experience in a team environment.
• Current DoD 8570.01-M IAT Level II certification with Continuing Education (e.g., CySA+, GICSP, GSEC, Security+ CE, SSCP).
• Must obtain a PenTest+ certification within 6 months of the start date.
• Active DoD Secret Security Clearance.

Preferred Qualifications

• Bachelor’s degree or higher in Cybersecurity, Computer Science, or a related field.
• Experience with Cyber Threat Emulation tools, policies, and procedures.
• Experience operating custom software on a Linux platform.
• Experience with security analysis and solutions in WAN/LAN environments, including Routers, Switches, and various Operating Systems (e.g., Windows, Linux).
• Familiarity with Security Operations Centers (SOC) and DCO tools/applications such as Firewalls, Intrusion Detection/Prevention Systems, Network Security Manager, and similar technologies.
• Experience performing security compliance scans (ACAS/Nessus preferred).
• Background in configuring, troubleshooting, and deploying host-based security solutions.
• Ability to mentor and train personnel in a fast-paced, evolving environment.
• Familiarity with DoD Security Operations Centers (SOC) protocols and DCO/CSSP-guided security policies.
• Active DoD Top Secret clearance.

Benefits & Perks

• 401(k)
• 401(k) matching
• Dental insurance
• Employee assistance program
• Health insurance
• Life insurance
• Paid time off
• Tuition reimbursement
• Vision insurance