Senior Incident Response Cybersecurity Analyst

Shape the future of defense with MANTECH! Join a team dedicated to safeguarding our nation through advanced tech and innovative solutions. Since 1968, we’ve been a trusted partner to the Department of Defense, delivering cutting‑edge projects that make a real impact. Dive into exciting opportunities in Cybersecurity, IT, Data Analytics and more. Propel your career forward and be part of something extraordinary. Your journey starts now—protect and innovate with MANTECH! MANTECH seeks a motivated, career and customer-oriented Senior Incident Response Cybersecurity Analyst to join our team in Doral, FL . This position uses a Panama schedule which includes 12 hour shifts; work shifts may include days, nights and weekends. Responsibilities include but are not limited to: Active monitoring of security alerts from SIEM, EDR, IDS/IPS, firewalls and cloud environments to identify potential anomalies and malicious activities. Rapidly analyzing and triaging incoming security alerts to distinguish true security incidents from false positives. Classifying the severity and potential business impact of confirmed security incidents to elevate them appropriately. Root Cause Analysis: Investigating logs (host, network, cloud, and application) to reconstruct the timeline of an attack and identify the entry point. Performing digital forensics on compromised endpoints, servers and network devices to extract malware artifacts and indicators of compromise (IOCs). Proactively searching network and endpoint data to identify undetected malicious activity that bypasses traditional security controls. Identifying and removing all remnants of the threat (e.g., deleting registry keys, removing malware, terminating malicious processes). Executing containment protocols to stop the spread of an attack, such as isolating affected hosts, blocking malicious IPs or disabling compromised user accounts. Coordinating with IT infrastructure teams to safely restore services from clean backups and verify system integrity post‑incident. Writing comprehensive After‑Action Reports that detail the technical root cause, impact and actions taken during the mitigation process. Minimum Qualifications: Bachelor’s degree in Information Technology, Cybersecurity, Computer Science or related field or 4 years of additional experience in lieu of a degree. 9+ years of position‑specific relevant experience in IT systems assessment, cybersecurity incident response, cybersecurity audit or a related role. Knowledge of various IT domains including applications, infrastructure, data and security. Demonstrated experience with facility management systems (FMS) or related building automation systems (BAS). Strong understanding of enterprise architecture frameworks (e.g., TOGAF, Zachman), experience with IT security standards, compliance (e.g., NIST, ISO 27001) and risk management methodologies. Proven ability to analyze complex data and generate actionable recommendations. Preferred Qualifications: Master’s degree in Information Technology, Cybersecurity, Computer Science or related field. Industry certifications such as Certified Information Systems Auditor (CISA), Certified Information Systems Security Professional (CISSP), Certified Facility Manager (CFM), TOGAF, COBIT, ITIL Foundation certificate or any relevant building automation system or FMS vendor certifications (e.g., Siemens, Johnson Controls, Schneider Electric). Experience at a DoD Combatant Command (e.g., SOUTHCOM, NORTHCOM, CENTCOM, CYBERCOM, INDOPACOM, EUCOM, AFRICOM, STRATCOM, TRANSCOM, SOCOM, SPACECOM) or a component is desired. Clearance Requirements: Must have an active/current Secret clearance. Must be eligible to obtain and maintain a TS/SCI security clearance. Physical Requirements: Must be able to be in a stationary position more than 50% of the time. Must be able to communicate, converse and exchange information with peers and senior personnel. Constantly operates a computer and other office productivity machinery, such as a computer. The person in this position frequently communicates with co‑workers, management and customers, which may involve delivering presentations. Must be able to exchange accurate information in these situations. The person in this position needs to occasionally move about inside the office to access file cabinets, office machinery, etc. MANTECH considers all qualified applicants for employment without regard to disability or veteran status or any other status protected under any federal, state or local law or regulation. If you need a reasonable accommodation to apply for a position with MANTECH, please email us at View email address on click.appcast.io and provide your name and contact information. #J-18808-Ljbffr