This week's openings with MAINSAIL Group! All positions REQUIRE a DoD security clearance and are in person at Lackland AFB, in San Antonio, TX, Hanscom AFB in Bedford, MA, Rockville, MD or Wright-Patterson AFB, OH. If you or someone you know has a clearance and is interested, please send resumes to careers@mainsailgroupinc.com so Terry Topouzoglou and Angell Nichols can review and find the best fit for you and the customer. Lackland AFB positions: Systems Interoperability & Integration Engineer SME (Secret) Hanscom AFB positions: Systems Engineer (Top Secret) Test Engineer (Secret) Acquisition Strategy & Documentation SME (Secret) Program Integration SME (Secret) Data Links & Communication Engineer SME (Top Secret) Program Management (Top Secret) Systems Interoperability & Integration Engineer SME (Secret) Configuration & CDRL Data Manager (CM/DM) (Secret) Systems Engineer (Top Secret) Communications Engineer (Top Secret) Acquisition Intelligence Support (Top Secret/SCI) Wright-Patterson AFB position: Program Management (Secret) Rockville, MD position Information Assurance Support Analyst (Secret)
MAINSAIL Group’s Post
More Relevant Posts
-
Question for anyone out there either running or working in an IT security operations team: What kind of changes to the team personnel have you seen in the last 2 years? I am used to seeing a blend of security analysts and security engineers. Most of the tasks happening between those team members will include: -Developing/implementing security controls -Direct incident response -Vuln Mgmt/Attack Surface Mgmt -Running the security stack (email/endpoint/cloud) -Detection/SOAR development and log collection oversight Am I missing something in my world view that needs to be factored into a more future-proof team design, or even a change to the types of work I expect to be done within a SOC team?
To view or add a comment, sign in
-
-
The most valuable thing I have learned from working on both sides of security, the Operations side and the Security side, is to better translate what different people want. An Auditor may say, "You must keep all security relevant logs for seven years." A Splunk Admin may interpret that as, "I need to keep all logs for seven years." An Auditor may only be concerned with items which have been surfaced as part of an Incident Response investigation, and is outside of Splunk anyway. Getting in between to provide some translation and really help make sure that what is provided is what is expected and to avoid over engineering a solution.
To view or add a comment, sign in
-
Monitoring may seem like collecting logs, but there's a lot of value to it: * Ability to assist with difficult systems debugging. * Analysis of resource usage to check on if your key infrastructure has enough compute resources dedicated to it or if it has too much. This ties in with cost savings. * Can provide usage metrics to understand where to efforts on product features. * This can also help with showing the business value of a feature add to the company to validate its spend. * Security auditing to ensure that only the people that should be logging in are doing so. Especially important if you're in any sort of SOC-2/PCI/HIPAA type compliance. Live by monitoring.
To view or add a comment, sign in
-
Security operations teams should be structured into three tiers to focus on key outcomes: Triage (tier 1): The first line of response for security incidents. Triage is focused on the high-volume processing of alerts and is generated by automation and tools. The triage processes solve most common incident types and resolve them within the team. More complex incidents, or incidents that have not been seen and resolved before, should be escalated to tier 2. Investigation (tier 2): Focuses on incidents that require further investigation, often requiring a correlation of data points from multiple sources. This investigation aims to provide repeatable solutions to issues escalated to tier 2. It then enables tier 1 to resolve later recurrences of that issue type. Tier 2 will also respond to alerts against business-critical systems to reflect the severity of the risk and the need to act quickly. Hunt (tier 3): Focuses primarily on proactive hunting for highly sophisticated attack processes and developing guidance to the wider teams. The tier 3 team also acts as an escalation point for major incidents to support forensic analysis and response. #threatintelligence #cloudadoption
To view or add a comment, sign in
-
-
Check out the great opportunities listed below!
Happy Wednesday, please share this with your networks to increase visibility for folks looking for positions like the ones below. Cyntel Technologies, LLC is hiring for multiple positions in the Geospatial/GIS/FMV/Imagery Intelligence space. All require TS/SCI and former MOS. Fort Liberty: ➡ Senior Geospatial Analyst (6+ years of Topographic/Imagery Analysis) (North Carolina) ➡ Expert Geospatial Analyst (8+ years of Topographic/Imagery Analysis & BA degree in relatable field) (North Carolina) ➡ Expert GIS Administrator (10+ years experience & BA degree) (North Carolina) ➡ Geospatial Systems Admin (5+ years supporting ADP & BA degree) (North Carolina) ➡ Senior Full Spectrum GEOINT (FSG) Analyst (6+ years experience performing PED & working knowledge of computer scripting languages) (North Carolina) ➡ Sr. FMV Analysts (6+ years of Intel experience, 4 of those 6 years directly involved with FMV) (North Carolina) For more information on these openings or our additional openings, CONUS and OCONUS, please message me on LinkedIn or visit our website to apply www.cynteltech.com
To view or add a comment, sign in
-
IBM’s most recent report detailed that it now takes on average 277 days for security teams to identify and contain a data breach - that breach life cycle continues to be a huge factor in the overall financial impact Businesses need to have an Incident Response Plan or Strategy - an expert team ready 24 x 7 to jump into action if the worst should happen to rapidly respond, contain and remediate. With Cybereason Incident Response Retainer, customers have the peace of mind that they have a team that can do this for them, please see below for more detail around what we can offer customers. https://lnkd.in/duqcztkD
To view or add a comment, sign in
-
-
The CrowdStrike outages are another reminder of how critical it is to demand rigor and excellence in your patch management process (In CrowdStrike's case) as well as the importance of your on-the-ground incident response team (In 70% of F100 companies' case) Most of the fixes/work arounds to critical systems affected by the outage had to be done hands-on with machines by on-the-ground teams. Let's hope there's not a next time, but in case there is IT Leaders should consider where their staff/consultants who can respond to incidents like this are physically located. If you are looking into how to find & select top-tier US-Based Security, Incident Response, Software, or Infrastructure staff let's discuss how Software Resources can partner with you. #IncidentResponse #PatchManagement #ITTalent #Staffing #Recruiting #LocalTalent
To view or add a comment, sign in
-
The best advice to become a smart contract developer or security researcher: "Show up" Everyday. And get 1% better than yesterday.
To view or add a comment, sign in
-
I've been there too! Early in my career, I accidentally updated a table. I've seen colleagues delete more data than intended because they missed a WHERE condition, and another who dropped a table in production. We've all got these stories, right? It's almost like a rite of passage. You mess up once, but you'll never do it again. Here are a few tips for all you SQL wizards: 💻 Automate your database changes: The tools these days are way better than 20 years ago, so there's no excuse to work directly on production. 🔐 Use Privileged Access escalation: Make sure production accounts have extra security steps to prevent accidents. 👥 Pair up for production changes: If you must make a change in a Production environment, like a hotfix or emergency update, always, always do it with another engineer. 📦 Backup before you act: Always have backups or take one before making changes in production. 🔄 Use Transactions for risky updates/deletes: This can save you from big headaches. ⏰ No Friday or end-of-day releases: Seriously, don't do it if you can avoid it.
The Crowdstrike outage reminds me of a time early in my career where I accidentally ran a SQL query on a production database and updated hundreds of thousands of lines before I could stop it. I cried in the toilet, thought I was going to lose my job, and just felt really terrible. Granted it wasn’t a global outage or too much chaos and actually led to some really worthwhile process changes, but mistakes happen and I hope the individual engineer(s) are not being too hard on themselves today. What is shocking is an organisation that size not having some basic processes in place which would’ve prevented it. ✅ Every change needs a PR, even the smallest, with 2 pairs of eyes. 🧪 Don’t ignore failing tests on a pipeline, ever. 🔎 Monitoring on critical services with hard-stops is essential. 💰 Resiliency testing is worth investing in. 🍺 Don’t release on Fridays. #crowdstrike #qa #resiliency
To view or add a comment, sign in
-
USF Cybersecurity Student 🤘🏾| CSAP | CCST Cybersecurity | Empowering people to make educated security decisions | Intrusion Analysis | GRC
Verizon's 2023 DBIR Report communicates that top attack patterns using System Intrusion, Social Engineering and Basic Web Application Attacks between SMBs and large corporations average around 89% of breaches (SMBs = 92% Large Corps = 85%). That being said, learning about these different attacks can help you reduce risk in your business. LetsDefend's "Detecting Web Attacks" course teaches five common web attacks: 1. SQL Injection (SQLi) 2. Command Injection 3. Cross-Site Scripting (XSS) 4. Insecure Direct Object Reference (IDOR) 5. Local File/Remote File Intrusion (LFI/RFI) What is the main takeaway? All of these attacks stem from a lack of input sanitization, that is any data taken from the user and passed to the server to retrieve information. Recommendations are to sanitize user input, but what does that really mean? Read more here: https://lnkd.in/eXyBYQ3y Implementation of secure coding techniques when in the "development" phase of the software development lifecycle (SDLC) is important! Some useful tips: 🔑 Use tried and true frameworks that have sanitization functions built-in. 🔑 During the maintenance phase of the SDLC, ensure these frameworks are updated 🔑 Test Test Test...Planned Unit, Static, Dynamic, and Penetration testing to ensure proper sanitization and system handling 🔑 Implement strong policies that enforce proper setup and maintenance of public-facing endpoints.
Web Attack Investigator
app.letsdefend.io
To view or add a comment, sign in
Administrative Support Specialist | Active Secret Security Clearance
5moKelsey Ghorley the one in Ohio!