CIPHER Agent Directory

Monitors, analyzes, and triages security events from SIEM and EDR. First responder to alerts — enriches, deduplicates, classifies severity, and escalates confirmed incidents.

Manages the full incident response lifecycle: detection, analysis, containment, eradication, recovery, and post-incident review. Coordinates agents and escalates to human operators.

Collects, preserves, and analyzes digital evidence in support of incident response and investigations. Maintains strict chain of custody and produces forensic reports.

Monitors and supports cybersecurity infrastructure components — firewalls, IDS/IPS, proxies, and security tooling. Identifies misconfigurations and degraded security controls.

Analyzes behavioral and technical indicators to detect and assess insider threats. Integrates UEBA data, access logs, and HR signals while maintaining privacy and legal boundaries.

Produces finished threat intelligence by analyzing adversary TTPs, campaigns, and indicators. Enriches IOCs, tracks threat actors, and maintains the organization's threat picture.

Identifies, assesses, and prioritizes vulnerabilities in organizational systems. Correlates CVEs with asset inventory, provides risk-scored remediation recommendations.

Supports cybercrime investigations by gathering and analyzing digital evidence. Operates exclusively in advisory mode — all investigative actions executed by human investigators.

Conducts detailed analysis of digital evidence to support investigations. Applies forensic techniques to extract, examine, and interpret digital artifacts.

Analyzes large datasets to identify patterns, anomalies, and security-relevant insights. Supports threat hunting and operational analytics across log and telemetry sources.

Administers and secures organizational databases, ensuring data integrity, access control, and monitoring for unauthorized access or exfiltration.

Manages the organization's cybersecurity knowledge base — maintaining playbooks, lessons learned, policy documents, and threat intelligence in accessible, structured form.

Monitors and supports secure operation of organizational networks. Identifies network anomalies, misconfigurations, and unauthorized devices or traffic patterns.

Administers and secures operating systems and endpoints. Monitors for configuration drift, unauthorized changes, and compliance with security baselines.

Analyzes system security posture, validates security controls, and identifies gaps between policy requirements and operational reality.

Provides technical support for cybersecurity tools and processes. Triages security tool issues, maintains operational tooling, and supports end-user security queries.

Designs and evaluates cybersecurity architectures for systems and networks. Assesses proposed designs against security requirements and organizational risk tolerance.

Integrates cybersecurity requirements into enterprise IT architecture. Ensures security is embedded in enterprise technology planning and system acquisitions.

Applies cybersecurity engineering principles to operational technology (OT), ICS, and SCADA systems. Bridges IT security practices with OT operational constraints.

Develops and reviews software with security embedded throughout the SDLC. Identifies and remediates security vulnerabilities in source code and dependencies.

Ensures security requirements are defined and verified throughout the systems development lifecycle for hardware, software, and integrated systems.

Evaluates software products and applications for security vulnerabilities through structured assessment methodologies including penetration testing and code analysis.

Translates organizational security objectives into actionable system security requirements. Ensures security requirements are complete, testable, and traceable.

Plans and executes security testing of systems to validate that security controls function as intended and meet specified requirements.

Researches emerging technologies, attack techniques, and defensive capabilities. Produces research findings that inform strategic security decisions and tool selection.

Oversees communications security policies and programs. Ensures secure communications channels are available, properly configured, and protected from interception.

Develops, reviews, and assesses cybersecurity policies, plans, and procedures. Ensures policies are current, aligned with standards, and enforced across the organization.

Manages cybersecurity workforce development programs. Identifies skill gaps, tracks certifications, and ensures training program alignment with operational needs.

Develops and delivers cybersecurity training content. Creates instructional materials aligned with NICE framework competencies and organizational security needs.

Provides legal analysis and guidance on cybersecurity-related matters. Advises on regulatory compliance, incident disclosure obligations, and legal aspects of incident response.

Provides strategic cybersecurity leadership and oversight. Synthesizes security program performance for executive decision-making and board-level reporting.

Oversees organizational compliance with privacy regulations. Assesses data handling practices, identifies privacy risks, and advises on privacy-preserving security controls.

Manages lifecycle and security of cybersecurity products and tools deployed in the organization. Tracks versions, licenses, EOL status, and vulnerability patches.

Manages cybersecurity programs — tracking milestones, resources, risks, and outcomes across multi-initiative security programs.

Manages cybersecurity projects with security embedded throughout the project lifecycle. Tracks security deliverables, risks, and outcomes.

Independently assesses the implementation and effectiveness of security controls. Produces findings for risk management and authorization decisions.

Supports Authorizing Officials with the information needed to make risk-based authorization decisions. Prepares authorization packages and monitors system security posture continuously.

Manages the overall cybersecurity posture of organizational systems. Oversees security monitoring, incident response, and security control maintenance.

Manages the cybersecurity technology portfolio — tracking investments, rationalization, and alignment of security tools with organizational needs.

Independently audits cybersecurity programs and controls for compliance with policies, standards, and regulatory requirements. Produces objective audit findings.