(Cyber) Incident Management Analyst - Hybrid with Security Clearance

Nightwing is supporting a U.S. Government customer to provide onsite incident response to civilian Government agencies and critical asset owners who experience cyber-attacks, providing immediate investigation and resolution. Responsibilities Correlate incident data to identify trends in reported incidents. Recommend defense‑in‑depth principles and practices (Defense in Multiple Places, layered defenses, security robustness, etc.). Perform Computer Network Defense incident triage to determine scope, urgency, and potential impact. Research and compile known resolution steps or workarounds to enable mitigation of potential Computer Network Defense incidents within the enterprise. Apply cybersecurity concepts to detect and defend against intrusions into small and large‑scale IT networks and conduct cursory analysis of log data. Monitor external data sources to maintain currency of Computer Network Defense threat condition and determine which security issues may impact the enterprise. Identify the cause of an incident and recognize key elements to ask external entities when learning the background and potential infection vector of an incident. Receive and analyze network alerts from various sources within the enterprise to determine possible causes. Track and document Computer Network Defense (CND) incidents from initial detection through final resolution, coordinating with other teams for information sharing. Shift work may be required; candidates may be assigned to set schedules for triaging and researching incidents for indicators of compromise (IOCs) and escalating to specialized analysts. Required Skills U.S. citizenship. Active TS/SCI clearance and ability to obtain DHS suitability. 5+ years of directly relevant experience in cyber incident management or cybersecurity operations. Knowledge of incident response and handling methodologies. Close familiarity with NIST 800-62 (latest revision) and FISMA standards as they pertain to reporting incidents. Ability to prioritize incidents, investigate phishing tactics, and identify gaps in incident reporting. Knowledge of general attack stages (footprinting and scanning, enumeration, gaining access, privilege escalation, maintaining access, network exploitation, covering tracks, etc.). Ability to recognize and categorize vulnerability types and associated attacks. Basic system administration and operating system hardening techniques. Knowledge of Computer Network Defense policies, procedures, and regulations. Awareness of operational threat environments (first generation [script kiddies], second generation [non‑nation‑state], third generation [nation‑state endorsed]). Understanding of system and application security threats and attack methods (e.g., buffer overflow, mobile code, cross‑site scripting, PL/SQL injections, race conditions, covert channels, replay, return‑oriented attacks, malicious code). Desired Skills Knowledge of operational threat environments (first generation [script kiddies], second generation [non‑nation‑state], third generation [nation‑state endorsed]). Understanding of system and application security threats and attack methods (e.g., buffer overflow, mobile code, cross‑site scripting, PL/SQL injections, race conditions, covert channels, replay, return‑oriented attacks, malicious code). Required Education BS in Incident Management, Operations Management, Cybersecurity, or related degree; or a high school diploma with 7–9 years of incident management or cybersecurity experience. Desired Certifications GCIH, GCFA, GISP, GCED, CCFP or CISSP. Location Arlington, VA. Equal Opportunity/Affirmative Action Statement Nightwing is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran status, age or any other federally protected class. #J-18808-Ljbffr Nightwing