Critical Infrastructure Cyber Protection & Defense Analyst

Essential Job Functions and Responsibilities: (Knowledge, skills, and behaviors required for this position.)

• Deliver professional advice, expertise, strategic insight, and other cyber-related consulting services to advance industrial control systems (ICS) cybersecurity for critical infrastructure.
• Provide advice and expertise in cybersecurity designs, implementation, vulnerability identification, and mitigation techniques and procedures that will aid industry and the Nation in securing critical infrastructure systems against current and emerging threats.
• Monitor critical infrastructure sector networks to actively remediate unauthorized activities.
• Respond to crises or urgent situations within critical infrastructure sectors to mitigate immediate and potential threats.
• Develop, research, and apply advanced mitigation, preparedness, and response and recovery approaches, as needed, to maximize survival of life, preservation of property, and information security.
• Lead cyber security efforts and deliver capability to customers.
• Promote an open and informal communication environment with both internal and external stakeholders at all levels in order to develop mutual trust and teamwork.
• Conduct information collection and analysis of United States critical infrastructure with particular emphasis on control systems and technology-controlled processes.
• Manage teams in the creation of cyber security products.
• Create related reports and provide briefings related to these issues.
• Conduct technical analysis projects.
• Work to fill gaps in current situational awareness across sectors and develop products to address the needs of a diverse customer set spanning multiple classification levels, federal, private, and international organizations.
• Other duties as assigned.

Education, Credentials, and Work Experience:

Required

• Bachelor of Science degree in mechanical or electrical engineering, cyber security/computer sciences, and/or business/financial management from an accredited institution.
• EX3: Education/Experience: Bachelor's and 5 years. Master's and 2 years. PhD and 2 years.
• EX4: Education/Experience: Bachelor's and 9 years. Master's and 6 years. PhD and 4 years.
• Relevant experience commensurate with level. Experience shall include designing or applying control systems cyber security solutions in critical infrastructure at the system and/or regional level.
• Obtain and maintain a Q security clearance and special access as required. When required, must be able to work in a secure work environment to include handling/storing/processing classified and CUI information, and adhere to physical and electronic projection standards.
• Testing Designated Position (TDP)
• Expertise in Splunk SPL, including advanced search commands, statistical functions, data models, and performance optimization
• Hands-on experience with Splunk Enterprise Security, including correlation searches, risk-based alerting (RBA), notable events, and the ES framework
• Hands-on experience with using the Splunk Monitoring Console to monitor and maintain the health of a distributed Splunk ecosystem.
• Hands-on experience with data transformation using props and transforms configurations and Splunk regular expressions
• Working knowledge of the Splunk AI Toolkit (AITK) for building and applying ML-based detections
• Experience with the Splunk App for Data Science and Deep Learning (DSDL), including custom model development and deployment
• Strong understanding of the MITRE ATT&CK framework and detection engineering methodology

Special Requirements

• Must be a US citizen.
• Must be eligible for a DOE Q clearance (equivalent to Top Secret) and SCI access.
• Must be able to work under pressure, simultaneously addressing multiple complex tasks to meet commitments while maintaining quality of work and a professional interface.

Preferred

• Professional Engineer and/or Certified Information Systems Security Professional (CISSP) certifications.
• Relevant experience to include program/project management here at INL, particularly in the cyber security realm, and familiarity with industrial control systems. In-depth knowledge of the US energy sector and experience working with DOE, DOD and DHS and private industry on grid security-related projects is beneficial.
• Experience with detection-as-code practices and tools (Git, CI/CD pipelines)
• Proficiency in Python for data processing and model development
• Knowledge of SOAR platforms and detection automation
• Relevant certifications (Splunk Certified Power User/Admin, Splunk Enterprise Security Certified Admin, GIAC, etc.)

Physical Requirements:

While performing the duties of this classification, the employee is frequently required to stand, walk, sit, stoop, kneel, bend, use hands to handle materials, manipulate tools, keyboard and type, reach with hands and arms, and operate job-related equipment. The employee must occasionally lift and/or move up to 30 pounds. Sufficient visual acuity and hearing capacity to perform the essential functions and interact with people is required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

Job Information:

• The pay range for this position is: Level #3 ($95,256 - $195,288) / Level #4 ($114,360 - $234,366). At Idaho National Laboratory compensation decisions are determined using factors such as education, relevant experience, and other credentials.
• Multi-Level: This is a multi-level posting and you will be placed at the appropriate level dependent on depth and breadth of proven experience and skills.
• TDP: This is a testing designated position; you will be required to submit to a pre-employment drug screen and periodic drug testing throughout the term of your employment.

Working Conditions:

The work environment is an office environment which may include stairs. The noise level is generally moderate; however, may be exposed to loud noises on occasion. Position requires working more than 8 hours/day, irregular hours, and working alone.

The above statements are intended to describe the general nature and levels of work being performed by people assigned to this classification. They are not intended to be construed as an exhaustive list of all responsibilities, duties and skills required of personnel so classified.

Security and Privacy Requirements:

This position includes information security and privacy responsibilities as defined by NIST SP 800 53, OMB Circular A 130, and DOE Order 206.1A. Position must complete initial and annual role-specific training as required. The incumbent must sign and comply with all required access agreements prior to being granted access to organizational systems or data. Comply with all applicable information security and privacy policies and procedures by following established protocols, with an understanding that non-compliance may result in sanctions.

Level Definers

EX3 - Career:

• Knowledge: Complete understanding and wide application of principles, theories, and concepts in field of specialization. General knowledge of other related disciplines. Resolves a wide range of issues in creative ways. This level is fully qualified, career oriented.
• Problem Solving: Works on problems of diverse scope. Demonstrates good judgment in selecting methods and techniques for obtaining solutions. Solutions are imaginative, thorough, practical, and consistent with organizational objectives.
• Discretion and Latitude: Works under only general direction. Normally receives little instruction day-to-day. Independently determines and develops approach to solutions. Work is reviewed upon completion for adequacy in meeting objectives.
• Impacts: Contributes to completion of specific programs and projects. Failure to obtain results or erroneous decisions or recommendations would typically result in program delays.
• Liaison: Frequent internal organizational customer contacts. May have some outside contact or represent organization in providing solutions to difficult issues associated with specific projects or work.
• Education/Experience: Bachelor's and 5 years. Master's and 2 years. PhD and 2 years.

EX4 - Senior:

• Knowledge: Technical leader with a high degree of knowledge in the overall field and recognized expertise in specific areas. Has wide-ranging experience. Uses professional concepts and company objectives to solve complex issues in creative and effective ways. Interfaces with and mentor junior staff.
• Problem Solving: Works on complex issues where analysis of situations or data requires an in-depth evaluation of variable factors. Exercises judgment in selecting methods, techniques, and evaluation criteria for obtaining results.
• Discretion and Latitude: Work is performed without appreciable direction. Determines methods and procedures on new assignments and may coordinate activities of other personnel (Lead). Exercises considerable latitude in determining objectives of assignment.
• Impacts: Guides the successful completion of major programs and may function in a project leadership role. Erroneous decisions or recommendations would typically result in failure to achieve organizational objectives.
• Liaison: Represents organization as prime contact on projects or work. Interacts with senior internal personnel on significant matters often requiring coordination between organizations. Networks with key contacts outside own area or expertise.
• Education/Experience: Bachelor's and 9 years. Master's and 6 years. PhD and 4 years.

Benefits and Relocation

• Medical, Dental, Vision, and Flexible Spending Accounts
• 401(k) with a 4.2% employer contribution and up to 4.8% match (regular positions) or self-contribute access (postdoctoral positions)
• Paid time off (personal leave)
• Employee Education Program (tuition assistance for eligible positions)
• Comprehensive Relocation Package
• Benefit eligibility subject to multiple factors, including employment status and position classification.

At this time, BEA will not sponsor any H1-B visas obtained outside of the United States of America (U.S.A.), including consular visas.

INL is a science-based, applied engineering national laboratory dedicated to supporting the U.S. Department of Energy's mission in nuclear energy research, science, and national defense. With more than 6,300 scientists, researchers, and support staff, the laboratory works with national and international governments, universities and industry partners to change the world's energy future and secure our nation's critical infrastructure.

INL Mission:

Our mission is to discover, demonstrate and secure innovative nuclear energy solutions, other clean energy options and critical infrastructure.

INL Vision:

Our vision is to change the world's energy future and secure our nation's critical infrastructure.

Selective Service Requirements:

To be eligible for employment at INL males born after December 31, 1959 must have registered with the Selective Service System (SSS). For more information see www.sss.gov.

Equal Employment Opportunity:

Idaho National Laboratory (INL) is an Equal Employment Opportunity (EEO) employer. It is the policy of INL to provide equal employment opportunities to all qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, protected veteran or disabled status, or genetic information.

Reasonable Accommodation:

We will ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment. Please contact us to request accommodation.

Other Information:

When applying to positions please provide a resume and answer all questions on the following screens. Applicants, who fail to provide a resume or answer the questions, may be deemed ineligible for consideration.