Cyber Incident Responder / Malware Analyst (CSOC)

Job Description

Job Description

Incident Responder / Malware Analyst (CSOC Tier 3)

Cyber Security Operations Specialist III - CSOC Tier 3

Location: Springfield, VA - on site

Time Type: Full time, Exempt

Clearance Required to Start: Active TS/SCI (U.S. citizenship required)

Additional Requirement: Must be able to obtain and maintain a Government polygraph (post-hire requirement)

Schedule: Supports a 24x7x365 incident response operation

Travel: None

Salary Range: $87,000 – $95,000

 

When an incident happens, you are the one who contains it.

RISA is hiring a CSOC Tier 3 analyst for the incident response team defending an Intelligence Community customer's enterprise. This is the top of the escalation chain: containment, eradication, and recovery, plus malware and implant analysis and forensic artifact work. When a Cyber Incident Response Team stands up, you work under the Government CIRT Commander; between incidents, you run the exercises that make the next response better. You will talk to the owner here, not a recruiting queue.

What You Will Do

• Implement containment measures during incidents - IP and domain blocks, account disablement - at Government direction.
• Perform digital media analysis on host, server, and network data, including volatile and non-volatile memory.
• Perform malware analysis and reverse engineering, and develop signatures and indicators of compromise.
• Categorize incidents, build timelines, and brief stakeholders on adversary activity and response actions.
• Coordinate with counterintelligence, insider threat, and law enforcement partners on advanced investigation and triage.
• Develop and, when authorized, run custom scripts and tools to collect and analyze data.
• Write incident investigation reports covering the full lifecycle of each incident, with corrective and TTP recommendations.
• Contribute to daily and weekly CSOC reporting, and quality-check a share of closed Tier 2 tickets each week.

What You'll Bring

• S. citizenship and an active TS/SCI.
• Ability to successfully obtain and maintain a Government polygraph after hire.
• Education and experience, per the contract labor category criteria: Bachelor's degree in a field applicable to the position plus 6 years of relevant experience. Equivalents accepted - Master's plus 4, Associate's plus 8, or High School diploma/GED plus 10.
• DoD 8140.01 / 8570.01-M IAT Level II and CSSP Incident Responder; IAT Level III and CSSP Incident Responder must be held or obtained within six months of start.
• Hands-on incident response: containment, eradication, and recovery.
• Host, network, and memory forensics, and malware analysis.
• Documentation disciplined enough that every action and analysis can be reconstructed from the ticket.

Nice to Have

• Master's degree.
• IAT Level III already in hand.

About RISA

Rolston Information Systems Assurance (RISA) is a Service-Disabled Veteran-Owned Small Business that has supported federal defense and intelligence cybersecurity missions for more than seventeen years. We are small on purpose: direct access to leadership, a real say in how the work gets done, and none of the layers that slow large primes down.

Benefits

Medical, dental, and vision insurance; 401(k) and Roth; Paid Time Off; and 11 paid Federal Holidays.

RISA is an Equal Opportunity Employer.

• Upon receiving an offer of employment, all applicants will be required to do a background check, including a criminal record check and employment/education verification.