Incident Response Analyst

Support preparation, detection, analysis, containment, eradication, recovery, and post-incident activities for cybersecurity events and incidents Investigate cybersecurity incidents affecting NIPRNet and SIPRNet environments Perform proactive security monitoring and analysis to identify potential intrusion attempts and malicious activity Analyze security information from SIEM platforms, endpoint-security capabilities, firewalls, IDS, IPS, web-security systems, antispam capabilities, malware-prevention systems, and related enforcement technologies Assess cybersecurity events to determine scope, potential impact, affected systems, and required response actions Support containment and mitigation of active cybersecurity threats in accordance with approved Government procedures Coordinate eradication and recovery activities with system owners, administrators, network personnel, cybersecurity teams, and technical stakeholders Collect and preserve technical evidence associated with cybersecurity events and incidents Maintain accurate incident records, timelines, supporting evidence, investigative findings, response actions, and status information Develop and contribute to required cybersecurity event and incident reporting Coordinate incident-response activities with SOC analysts, CSSPs, system owners, technical teams, and Government stakeholders Support escalation of significant cybersecurity events and incidents in accordance with established procedures Provide timely status updates during active investigations and incident-response activities Support post-incident analysis and lessons learned to improve monitoring, detection, response procedures, and defensive capabilities Participate in after-hours incident response when assigned and meet the contract-required one-hour recall requirement Requirements Bachelor’s degree and 5 or more years of relevant cybersecurity experience; specific experience, education and training may be considered in lieu of degree Experience supporting cybersecurity incident response, Security Operations Center operations, cyber defense, or security-event investigation Experience analyzing cybersecurity events and determining appropriate response or escalation actions Experience supporting incident containment, eradication, recovery, and post-incident activities Experience monitoring and analyzing enterprise cybersecurity tools and security telemetry Experience documenting incident timelines, investigative findings, evidence, response actions, and status Experience coordinating cybersecurity incidents across technical teams and stakeholder organizations Working knowledge of network, endpoint, and enterprise cybersecurity monitoring concepts Ability to recognize potential intrusion activity and support rapid mitigation of cybersecurity threats Ability to communicate clearly during active cybersecurity incidents and maintain accurate documentation under time-sensitive conditions Ability to support after-hours incident response and the required one-hour recall when assigned U.S. Citizenship required Active Secret security clearance required at time of consideration Preferred: experience supporting cybersecurity incident response within Department of Defense or Federal environments Preferred: experience responding to incidents in both unclassified and classified network environments Preferred: experience with SIEM platforms and enterprise security-monitoring capabilities Preferred: experience analyzing endpoint-security, firewall, IDS, IPS, web-security, antispam, or malware-prevention data Preferred: experience supporting evidence collection and preservation during cybersecurity investigations Preferred: experience coordinating incident response with SOC personnel, CSSPs, system owners, network teams, and other technical organizations Preferred: experience operating in a 24x7 cybersecurity operations environment or supporting after-hours incident response Preferred: familiarity with Department of Defense cybersecurity incident-response processes and requirements Preferred: familiarity with DHRA, DMDC, or comparable Department of Defense enterprise environments Core Competencies Demonstrates expertise in cybersecurity incident response, including containment, eradication, and recovery activities. Proficient in analyzing security information from various cybersecurity tools and coordinating incident response across technical teams and stakeholders. Highest-signal resume keywords Cybersecurity Incident Response Security Operations Center Operations SIEM Platform Analysis Incident Documentation and Reporting Network and Endpoint Security Monitoring Hard Skills Cybersecurity Analysis Incident Containment Malware Prevention Intrusion Detection Systems Firewall Management Endpoint Security Security Telemetry Monitoring Evidence Collection Post-Incident Analysis Cyber Defense Soft Skills Clear Communication Time Management Collaboration Certifications & Qualifications Active Secret Security Clearance Industry Keywords NIPRNet SIPRNet Department of Defense Federal Environments Cybersecurity Operations Incident Response Procedures Tools & Technologies SIEM Platforms Endpoint-Security Tools Firewalls Intrusion Detection Systems Intrusion Prevention Systems Web-Security Systems Antispam Technologies Malware-Prevention Systems #J-18808-Ljbffr