Cybersecurity Incident and Application Analyst

Description * This position is contingent upon a future opening with Gunnison. Salary: $130,000 - $145,000/year Work location : Hybrid, 2-3 days per week on-site in Bethesda, MD. Support cybersecurity incident detection, analysis, response, containment, recovery, and post-incident activities across NIH CIT enterprise network, web application, endpoint, server, and cloud environments. Monitor, investigate, validate, and triage security events, alerts, suspicious activity, and potential indicators of compromise; assign appropriate severity and criticality based on operational impact, threat context, and established escalation procedures. Apply the enterprise incident-response lifecycle: preparation; detection and analysis; containment, eradication, and recovery; and post-incident analysis. Analyze network traffic, system logs, endpoint telemetry, application activity, authentication events, and security-tool alerts to identify malicious, anomalous, or unauthorized activity. Evaluate network, web application, cloud, and endpoint environments for insecure configurations, vulnerable ports, unnecessary services, weak protocols, default credentials, insecure communication methods, and other security weaknesses. Perform cybersecurity incident analysis using tools and platforms such as FireEye or comparable endpoint/threat-detection technologies, Palo Alto IDS/IPS and firewall technologies, Splunk SIEM, Tenable vulnerability-management tools, and related security operations tools. Support investigation of web application and cloud security events, including suspicious access, misconfigurations, exposed services, anomalous traffic, unauthorized changes, and potential data-security risks. Maintain a working knowledge of common ports, protocols, network services, attack vectors, and security-control configurations relevant to incident investigation and response. Conduct or support incident containment and recovery activities in coordination with system owners, network engineers, cybersecurity engineers, application teams, and Government stakeholders. Create, update, and follow incident response playbooks, standard operating procedures, RACI charts, escalation matrices, and communication plans. Document incident timelines, investigative steps, evidence, findings, impact analysis, containment actions, recovery actions, and recommended corrective measures. Lead or support post-incident reviews and lessons-learned activities; assess the effectiveness of the Incident Response Plan (IRP), playbooks, and procedures, and recommend improvements. Assist with annual incident-response exercises, tabletop exercises, and technical tests; document test results, gaps, corrective actions, and updates to incident-response documentation. Produce accurate, timely incident reports, status updates, dashboards, executive summaries, and management briefings appropriate for technical and nontechnical stakeholders. Maintain familiarity with NIST SP 800-61 incident-handling guidance and apply it to daily incident-response operations. Requirements Minimum of two (2) to five (5) years of progressively responsible experience in cybersecurity incident response, security operations, network security, application security, cloud security, threat detection, or a related discipline. Candidates should demonstrate experience in: Security-event monitoring, alert triage, incident investigation, incident documentation, escalation, and response coordination. Enterprise incident-response processes, including preparation, detection and analysis, containment, eradication, recovery, and post-incident activities. Network security, web application security, cloud technologies, endpoint security, and security monitoring. Identifying vulnerable services, insecure ports and protocols, default or weak configurations, and common network/application security weaknesses. SIEM analysis, preferably Splunk, including log searches, dashboards, correlation, alert analysis, and report generation. IDS/IPS, firewalls, endpoint detection and response, vulnerability-management, and threat-detection technologies, including Palo Alto, FireEye or comparable platforms, and Tenable. Windows and Linux operating systems, including basic system/log analysis and security troubleshooting. NIST SP 800-61 and the creation or use of incident-response playbooks, RACI charts, escalation procedures, SOPs, and lessons-learned documentation. Preparing technical findings, incident reports, management updates, and executive-level summaries. Bachelor’s degree from an accredited college or university in cybersecurity, information assurance, computer science, information systems, computer engineering, network engineering, digital forensics, systems engineering, or a closely related technical discipline. EC-Council Certified Incident Handler (E|CIH), current and active Offensive Security Certified Professional (OSCP), current and active GIAC Certified Incident Handler (GCIH), current and active Current Splunk certification, such as Splunk Core Certified Power User, Splunk Enterprise Certified Admin, Splunk Core Certified Advanced Power User, or an equivalent Splunk security/engineering credential Clearance Requirement: Ability to obtain and maintain a Public Trust. Desired Qualifications Master’s degree in cybersecurity, information assurance, computer science, digital forensics, information systems, engineering, data analytics, or a related technical discipline. GIAC Certified Intrusion Analyst (GCIA) GIAC Security Essentials (GSEC) GIAC Certified Forensic Analyst (GCFA) GIAC Reverse Engineering Malware (GREM) GIAC Penetration Tester (GPEN) CompTIA Security+, CySA+, PenTest+, or CASP+ Certified Ethical Hacker (CEH) Certified Information Systems Security Professional (CISSP) Palo Alto Networks Certified Network Security Engineer (PCNSE) or related Palo Alto credential Tenable/Nessus platform training or certification FireEye, Trellix, Microsoft Defender, CrowdStrike, SentinelOne, or comparable EDR/XDR training AWS Certified Security - Specialty Microsoft Certified: Azure Security Engineer Associate Google Professional Cloud Security Engineer Cisco CyberOps Associate/Professional, CCNP Security, or equivalent network-security certification ITIL Foundation, particularly for candidates supporting formal incident, problem, and change-management processes The salary range for this position depends upon multiple factors including location, the individual's knowledge, skills, competencies, and experience, and contract-specific budget constraints and organizational requirements. Gunnison Consulting Group's total compensation package also includes bonus and profit-sharing opportunities, depending on company and employee performance. Available employee benefits include: 3 weeks of Personal Leave your first year 11 paid Holidays each year 5 days of Flexible Time Off each year for approved training or certifications (self-study is ineligible) 401(k) company match at 50% up to 10% of your salary Medical, Dental and Vision Insurance Life and Disability Insurance Public Transportation Subsidies Certifications and Training Allowance - Up to $5,000/year! Why Join Gunnison? Gunnison takes on ambitious projects. We target fun, challenging work that requires creative thinking and innovation. Quality is our top priority. Gunnison employee benefits meet or exceed what other companies in the Washington, D.C. metropolitan area offer. There is a great sense of camaraderie at Gunnison. This is an atmosphere we will maintain as we continue to grow. We are growing rapidly and the opportunity for individual professional growth with Gunnison is outstanding. We hire for careers at Gunnison, not to fill a position. Equal Opportunity/Affirmative Action Employer. Must be eligible for employment in the United States. We are unable to sponsor candidates at this time. In 1994 Gunnison began serving the greater Washington, D.C. metro area, focused on tackling our customers' most ambitious technology projects . By creating a culture dedicated to enabling our customers and employees to achieve more than they ever thought they could , the company has thrived for over 25 years. #J-18808-Ljbffr Gunnison Consulting Group Inc