Incident Handler - Senior

Peraton Overview

Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world’s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees do the can’t be done by solving the most daunting challenges facing our customers. Visit peraton.com to learn how we’re keeping people around the world safe and secure.

Responsibilities

Peraton is currently seeking a Senior Cyber Incident Response Analyst

The Senior Cyber Incident Response Analyst conducts highly technical investigations into cyber security incidents, managing the full incident lifecycle from initial detection and triage through containment, eradication, recovery, and post-incident review. This role is responsible for coordinating incident response activities with GCC teams, supported unit commanders, NETCOM, and ARCYBER; working with the forensics SME to investigate incidents and analyze digital evidence; documenting incident scope, impact, root cause, and remediation actions; maintaining complete case records; and developing response playbooks, lessons learned, and process improvements to strengthen the GCC Cybersecurity Service Provider (CSSP) mission.

Manage the full cyber incident lifecycle — from initial detection and triage through containment, eradication, recovery, and post-incident review — ensuring all actions are executed in accordance with NIST SP 800-61 Rev. 3 and Army incident response procedures.

Coordinate with internal GCC teams, supported unit commanders, NETCOM, and ARCYBER during active cyber incidents, serving as the primary point of contact for incident status updates and ensuring timely, accurate communication.

Produce comprehensive analysis reports that document the timeline, scope, impact, root cause, and remediation actions for each cyber incident.

Maintain accurate and up-to-date incident tracking records, ensuring all case data, evidence artifacts, analyst notes, and closure documentation meet GCC quality standards and audit requirements.

Ability to conduct post-incident reviews and lessons-learned sessions following significant cyber events, identifying process gaps, detection failures, and response inefficiencies, and translating findings into actionable improvements for the GCC CSSP.

Serve as a technical leader by providing mentorship to associate-level staff, performing quality assurance reviews of team output.

Develop, maintain, and exercise incident response playbooks for common attack scenarios (ransomware, phishing, credential theft, insider threat), ensuring procedures remain current with the evolving threat landscape, Army policy requirements, and mission success.

Qualifications

2 years with BS/BA; 4 years w/Associates; 0 years with MS/MA; 6 years with no degree, must hold certification for DOD 8140 DCWF 531 Advanced prior to start date.

Ability to obtain DoD Secret Clearance but an active DoD Secret Clearance is preferred.

Experience with ServiceNow Security Operations (SecOps) module for incident tracking and SLA management

Proficiency with Elastic Stack for SIEM-based alert triage, event correlation, and incident timeline reconstruction

Working knowledge of NIST SP 800-61 Rev.3 Computer Security Incident Handling Guide and DoD/Army incident response policy frameworks

Experience developing and exercising incident response playbooks for common cyber-attack scenarios in a DoD environment

Familiarity with digital forensics tools and techniques for evidence collection, chain of custody, and artifact analysis

Experience operating in a 24/7 CSSP or SOC environment supporting classified Army or DoW networks

Target Salary Range

$80,000 - $128,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual’s experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.

Benefits Statement

Peraton offers eligible employees a variety of benefits including medical, dental, vision, life, health savings account, short/long term disability, EAP, parental leave, 401(k), paid time off (PTO) for vacation, and company paid holidays. A full listing of available benefits can be viewed at  .

Application Statements

The application period for the job is estimated to be 30 days from the job posting date. However, this timeline may be shortened or extended depending on business needs and the availability of qualified candidates.

By applying to this job, you are expressing interest in the role and the Company. During the review of your application, you may be required to participate in an on-camera interview, as well as participate in a process to verify your identity.

Use of artificial intelligence (AI) tools of any kind during Peraton interviews is strictly prohibited unless the candidate has obtained prior written authorization. All interview responses must be the candidate’s own.

EEO

EEO: Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.