The Case Management Analyst (CMA) supports the client’s cyber incident report case management and workflows, as well as for the overarching process of ingesting, triaging, assigning, tracking, and closing cyber incidents reported. Cases are assigned to the client’s components to work with affected entities and resolve the incidents. The CMA conducts Quality Assurance and Quality Control on cases and the case management process while supporting activities to maintain and improve  case management processes, workflows, and incident reporting. The CMA supports the Branch’s program and processes to obtain incident reports from covered entities that do not report covered cyber incidents or ransom payments to the client. The CMA also receives, processes, and tracks requests for information (RFI) and requests for service.

This position performs all duties and responsibilities in accordance with the Mission, Vision, and Core Values of Cayuse.

• Assist in the development of overarching process for receiving, triaging, assigning, tracking, closing, and finalizing the record of reported cyber incidents, per legislative requirements.
• Draft organizational documentation such as Concept of Operations, Standard Operating Procedures, Work Instructions, for the Case Management Branch to process increased cyber incident reporting to the client..
• Ensure implementation of the cyber incident reporting processes, staffing, and technologies.
• Assess and Identify opportunities to increase the efficacy of cyber incident report handling and workflows.
• Document challenges, coordinate across teams to identify opportunities for process improvement, and recommend solutions to ensure incident reporting life cycle success.
• Quality Assurance/Quality Control:
  • Track cyber cases, incidents, and requests to ensure resolution in accordance with established timelines.
  • Audit cases to ensure SOP and work instruction compliance.
  • Perform Unified Ticketing System (UTS) administrative functions.
  • Coordinate with stakeholders to Identify lifecycle management process gaps and provide mitigation recommendations.
  • Review and update the UTS and Incident Reporting Portal (IRP) requirements.
  • Coordinate stakeholder and Service Desk processes and tool interoperability.
  • Define, measure, and report on the client’s incident lifecycle management key performance indicators.
• Reports and Analysis:
  • Review cyber incident information and conduct analysis to enrich the client’s Central Awareness Messages, Situation Reports, and Senior Leadership Notes.
  • Update case information in UTS.
  • Conduct analysis of incidents/cases to identify correlation between cyber, physical, and/or communications incidents.
  • Perform analysis of incident/case information and coordinate with stakeholders to ensure holistic analysis results.
  • Develop and distribute authoritative data on incident reports and cases.
• Cyber Incident Report Monitoring:
  • Develop, maintain, and update processes and procedures for identifying, and responding to unreported, or incorrectly reported, CIRCIA covered incidents and ransom payments.
  • Educate components on agency processes and procedures used to address unreported, or incorrectly reported, CIRCIA covered incidents.
  • Support the client’s CIRCIA compliance process.
  • Prepare episodic and annual CIRCIA reports to Congress.
  • Publish internal and external reports on CIRCIA metrics.

• Other duties as assigned.

• Bachelor’s Degree in a related discipline such as Homeland Security or Business.
• Additional two (2) years of experience with an Associate’s Degree may be substituted for a Bachelor’s Degree.
• Additional (4) four years of military and/or similar experience with a high school diploma may be may be substituted for a Bachelor’s Degree.
• Expertise in research, analysis, and writing skills with the ability to perform triage on questions, issues, or events in a time sensitive environment.
• Active contributor to projects, or project steps within a broader project, and maintain accountability for on-going activities or objectives.
• Experience in providing solutions to complex problems which require regular use of ingenuity and creativity.
• Demonstrated ability to work independently, receiving minimal guidance.
• Developed formal, written guidelines or instructions with operational and technical components.
• Understand organizational structure and alignment to business operations.
• Security+ certification desired.
• Active Top Secret/SCI security clearance and ability to obtain and maintain DHS Fitness.
• Must have between zero (0) and two (2) years of related experience.
• Active Top Secret/SCI security clearance and ability to obtain and maintain DHS Fitness
• Must be able to pass a background check. May require additional background checks as required by projects and/or clients at any time during employment.

Minimum Skills:

• Excellent written and verbal communication skills, including ability to interact effectively with all levels throughout Company organization.
• Shall have the requisite skills, expertise, and experience to perform the requirements of each task.
• Must be extremely detail-oriented and well organized.
• Must have proficient skills using Microsoft and Google Suite Products (Word, Excel, Power Point) and be able to learn new software as the situation dictates.
• Demonstrated ability to provide necessary attention to solve different level problems with some supervision.
• Broad expertise in research, analysis, and writing skills and be able to perform triage on questions, issues, or events involving the nation's Critical Infrastructures, Cyber and Key Resources. 
• Familiarity and understanding of known cyber threat actors and ransomware variants.
• Ability and experience with Special Handling Caveats and use of Traffic Light Protocol (TLP).
• Ability to use Mission Operating Environment (MOE) system, Remedy, and Service Now.

Our Commitment to you / overview of benefits

• Medical, Dental and Vision Insurance; Wellness Program
• Flexible Spending Accounts (Healthcare, Dependent Care, Commuter)
• Short-Term and Long-Term Disability options
• Basic Life and AD&D Insurance (Company Provided)
• Voluntary Life and AD&D options
• 401(k) Retirement Savings Plan with matching after one year
• Paid Time Off 

Reports to: Program Manager

Working Conditions

• Professional office environment.
• Must be physically and mentally able to perform duties extended periods of time.
• Ability to use a computer and other office productivity tools with sufficient speed to meet the demands of this position.
• Must be able to establish a productive and professional workspace.
• Must be able to sit for long periods of time looking at computer screen.
• May be asked to work a flexible schedule which may include holidays.
• May be asked to travel for business or professional development purposes.
• May be asked to work hours outside of normal business hours.

Other Duties: Please note this job description is not designed to cover or contain a comprehensive list of activities, duties or responsibilities that are required of the employee for this job.  Duties, responsibilities, and activities may change at any time with or without notice.

Cayuse is an Equal Opportunity Employer.  All employment decisions are based on merit, qualifications, skills, and abilities. All qualified applicants will receive consideration for employment in accordance with any applicable federal, state, or local law.