CSIRT Analyst

Corinth Consulting Group

30d • $70,000 - $80,000 • Onsite

About The Position

We are seeking a CSIRT Analyst to support 24x7 cybersecurity monitoring, incident response, and threat mitigation operations within a Security Operations Center (SOC) environment. The CSIRT serves as the primary incident response function of the SOC and is responsible for identifying, analyzing, responding to, and reporting cybersecurity events and incidents.

This role is critical to minimizing the impact of cyber incidents, coordinating recovery activities, and strengthening defenses to prevent future events. The ideal candidate has a strong foundation in incident response, security monitoring, and cyber threat analysis, and is familiar with the MITRE ATT&CK framework.

Requirements

• Bachelor’s degree or a minimum of one (1) year of experience in cybersecurity operations or incident response
• At least one active cybersecurity certification, such as: CompTIA Security+ ISC2 CISSP Or other comparable certification (subject to approval)
• Knowledge of computer security incident response principles and practices
• Familiarity with SOC operations and incident tracking workflows
• Ability to obtain and maintain a Top Secret clearance

Nice To Haves

• Experience working in a SOC or CSIRT environment
• Familiarity with the MITRE ATT&CK framework
• Strong analytical and documentation skills
• Ability to work effectively in a shift‑based, high‑tempo operational environment
• Strong communication skills for technical and non‑technical audiences

Responsibilities

• Provide 24x7x365 on‑site monitoring and incident recording of security alerts and events in near real time
• Analyze security data from multiple sources including security tools, system logs, and external reports
• Track and manage incidents using platforms such as Swimlane, ServiceNow, and DHS ECOP
• Conduct packet‑level traffic analysis and reconstruct network activity to identify anomalies and threats
• Perform in‑depth web and email log analysis to identify suspicious or malicious activity
• Analyze phishing emails and suspicious files to identify malicious code and indicators of compromise
• Determine command‑and‑control indicators and recommend tactical mitigation measures (e.g., internet filtering)
• Coordinate and advise Incident Response Handlers during active security incidents
• Support coordinated incident response and reporting in accordance with policies
• Develop, maintain, and follow documented SOPs, automated playbooks, and SOC CONOPS
• Provide security situational awareness and coordinate with SOC leadership, CISO, DCISO, and Privacy officials
• Participate in critical incident bridge calls and component SOC coordination calls
• Produce timely incident reports, resolution emails, and weekly, monthly, and quarterly metrics and summaries
• Support monitoring and response to email‑based threats, including phishing and spear-phishing campaigns

Benefits

• Corinth offers a comprehensive benefits package to support employees’ health, well‑being, and financial security.
• Benefits for eligible employees include multiple medical plan options, dental and vision coverage, health savings and flexible spending accounts, employer‑sponsored life and disability insurance, and access to wellness and health advocacy resources.
• Employees are also eligible to participate in a 401(k) retirement savings plan with company match and immediate vesting.
• Paid time off benefits include paid holidays, paid time off (PTO), sick leave, paid volunteer time, parental leave, and other leave programs.
• All employees have access to an Employee Assistance Program (EAP) offering confidential counseling and support services.
• Professional development and training opportunities are also provided.

What This Job Offers

• Job Type: Full-time
• Career Level: Entry Level
• Number of Employees: 1-10 employees