Senior Cyber Incident Responder

Senior Cyber Incident Responder The Opportunity The candidate shall provide Incident Response within a 24/7/365 SOC. The candidate will be responsible for coordination, execution, and implementation of all actions required for the containment, eradication, and recovery measures for events and incidents. This includes malware analysis, forensic artifact handling and analysis. In addition, while not in a period of incident response, the role requires participation in continuous exercises and dry runs to improve overall process improvement. Responsibilities Coordinate and execute tasks, performing analysis, and building/documenting response activities required during cyber security incident response, to include but not limited to actions such as implementing containment measures, IP blocks, domain blocks, and disabling user accounts on direction of the Government. Coordinate with other stakeholders as appropriate to ensure incidents are properly reported, contained, and eradicated. Coordinate with other contracts, organizations, activities, and services to ensure NGA recovers from an incident/event. Build timelines, documents, briefings, and other products as required to inform stakeholders of incident response actions, analysis, and the impact of both adversary activity and blue force response actions. Document actions taken and analysis in the authorized ticketing system to a level of detail where the actions taken and analysis are capable of being systematically reconstructed. Serve as C-IRT members as required and serve under the direct control of, and take direction from, the Government C-IRT Commander. Develop incident investigation reports within 30 days of C-IRT stand‑down, including the entire lifecycle of the incident and the response, with recommendations for corrective actions and new TTPs. Conduct quality control reviews of tickets worked by more junior analysts to ensure proper analysis, categorization, documentation, and notification. Qualifications Required TS/SCI clearance with the ability to obtain a polygraph. Minimum 4 years of experience in an incident response role or similar. Knowledge of complex enterprise cybersecurity systems and technologies and ability to interpret network and web architecture documentation. Experience providing briefings to an executive audience. Certified DoD 8140.01 and 8570.01-M Information Assurance Technical Officer (IAT) Level III. Certified DoD 8140.01 and 8570.01-M CSSP Incident Responder. Excellent verbal and writing skills with the ability to write clear and concise assessment reports. Strong understanding of adversarial tactics and techniques as it applies to defensive cyber operations. Strong understanding of both network and host‑based tactics. Good understanding of web application exploitation techniques.Strong understanding of the attack lifecycle. Good understanding of defense evasion techniques. Bachelor’s degree in Computer Science, Cyber Security Engineering, or IT‑related discipline. With an additional 8 years of experience in the cybersecurity field, additional years of experience may be substituted for a degree. Desired 6 or more years of experience supporting an IC or DoD agency with defensive cyber operations in cloud environments, including hybrid multi‑cloud environments. Proficiency in vendor‑agnostic cloud security concepts. Strong understanding of the Intelligence Lifecycle and its application to cyber threat intelligence reporting. Pay Range $90,300 – $189,600 ACEs is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, age, national origin, disability, status as a protected veteran, or any other protected characteristic. #J-18808-Ljbffr SwiftCruit