Cyber Technical Intelligence Analyst

The NYC Department of Buildings (DOB) is responsible for ensuring the safe and lawful use of buildings and properties by enforcing the NYC Construction Codes, Energy Code and Zoning Resolution. We facilitate compliant development with integrity, efficiency and professionalism. DOB is committed to becoming a premier municipal building organization, dedicated to enhancing the quality of life for all New Yorkers and making our city safer. We are committed to improving our performance and developing procedures that are streamlined, understandable and transparent. We are seeking a Cyber Technical Intelligence Analyst. Cyber Technical Intelligence Analyst will perform critical functions within the Threat Management discipline by consuming and analyzing tactical and technical intel, as well as coordinating between New York City Cyber Command and Office of Technology & Innovation Info Sec.

Responsibilities

Provide intel support and directly assist or execute investigative efforts or tasks; Assist hunt missions to augment detection capabilities to identify threats across DOB's IT operating environment; Responsible for the collection, processing, analysis, and dissemination of tactical intelligence (IOCs) and products (finished reports); Develop, maintain, and execute threat and risk communication processes; Perform network, system, and kill chain analysis on how malware was introduced and propagated; Conduct research for tracking certain code families, campaigns, or actors through technical analysis of data, malicious codes, and infrastructure; Employ predictive analytic methods to determine changes in adversary's capabilities, motivations, and intent, while providing recommendations to reduce risk before exposure to threats occur; Characterize and analyze network traffic and server/cloud performance metrics to identify anomalous activity and potential threats; Resolve New York City Cyber Command's Security Operations Center remediation requests; Provide direct analytic support, threat hunting, detection engineering to the Security Operations Center, including Incident Response and Risk Analysts, to add context to active investigations and threats using intelligence; Follow up on incident reports and app scan reports to ensure that proper mitigation is taking place in timely manner; Investigate suspicious traffic and identify potential attacks, false positives, and missed detections; Conduct network monitoring and intrusion detection analysis using various computer network defense tools, such as intrusion detection/prevention systems, firewalls and host-based security systems; review and adjust ACL as needed based on source/destination/port by requirement; Conduct log-based and endpoint-based threat detection to detect and protect against threats coming from multiple sources; Correlate activity across assets (endpoint, network, apps) and environments (on-premises, cloud) to identify patterns of anomalous or suspicious activity; Support the creation of business continuity/disaster recovery plans, including conducting disaster recovery tests, publishing test results and making changes necessary to address deficiencies; Research emerging threats and vulnerabilities to aid in the identification of incidents; Provide users with incident response support, including mitigating actions to contain activity and facilitating forensic analysis when necessary; Design, implement, audit, and maintain ThreatLocker policies; Manage ThreatLocker Application Whitelisting, Ringfencing, Storage Control, and Elevation Control; Use scripting and automation tools, including PowerShell, Python, Power Automate, and Microsoft Graph API, to improve mobile service capabilities; Subject matter expert in mobile (MDM) architecture, device management, and security; Create and present custom threat briefing materials for tactical situational awareness; Handle special projects and initiatives as assigned

Requirements

A baccalaureate degree from an accredited college and four years of satisfactory full-time experience related to projects and policies required by the particular position; or education and/or experience which is equivalent to the above

Benefits

Possible eligibility for remote work up to 2 days per week under the Remote Work Pilot Program