Cybersecurity Analyst - Operations Watch Analyst

3 Reasons Consulting is seeking a skilled Cybersecurity Analyst - Operations Watch Analyst to join our cybersecurity operations team in Stuttgart, Germany. This position is responsible for isolating, investigating, validating, and responding to suspicious cyber events and incidents. The Analyst will ensure compliance with CJCSM 6510.01B reporting requirements, provide incident response support, and perform forensic analysis to protect mission-critical systems. The role operates in a 24/7/365 watch environment, requiring shift flexibility and the ability to respond rapidly to emerging cyber threats., * Monitor, detect, and analyze network intrusion activity to identify suspicious or malicious events.

• Validate suspicious events, determine incident severity, and enter information into the appropriate reporting system.
• Ensure compliance with CJCSM 6510.01B and other relevant directives.
• Provide incident response support for the Cybersecurity Service Provider (CSSP) and subscriber sites.
• Coordinate with JFHQ-DoDIN and supported entities to ensure timely reporting and analysis of significant incidents.
• Conduct network and host-based forensic analysis (Windows and other operating systems).
• Perform full packet capture (PCAP) analysis using Wireshark and related tools.
• Conduct log correlation and analysis with Splunk and supplemental platforms.
• Develop and implement IDS/IPS signatures and assist with signature tuning.
• Participate in program reviews, evaluations, and certification assessments.
• Provide 24/7 support with shift schedules of four (4) ten-hour days per week, including one weekend day.

Do you have experience in Windows?, Do you have a Bachelor's degree?, * U.S. Citizenship required

• Bachelor's degree in a relevant discipline OR minimum 3 years of relevant experience (DoD preferred)
• Experience with incident validation, response, and reporting
• Knowledge of IDS/IPS, packet analysis, and log aggregation tools
• Ability to work rotating shifts in a 24/7 operational environment
• Up to 15% global travel; must be able to travel on short notice (72 hours), * 5+ years of incident response experience
• Knowledge of CJCSM 6510.01B and DoD incident response processes
• Experience with digital forensics and host-based security tools
• Strong analytical skills and independent problem-solving ability
• Excellent verbal and written communication skills, * Incident response and forensics
• Packet capture analysis (PCAP)
• Splunk and log correlation tools
• IDS/IPS development and monitoring
• Strong analytical and communication abilities

• Basic Life Insurance
• Direct Payroll Deposit
• Leave Accrual
• Holidays
• 401(k) Match

Employee / Company Shared Benefits:

• Additional (Voluntary) Life Insurance
• 401(k)
• Medical Coverage
• Dental Coverage
• Vision Care Plan
• Flexible Spending Account Plan