SITEC - Cyber Defense Incident Responder - MacDill AFB

Peraton•Tampa, FL

11d•$80,000 - $128,000•Onsite

About The Position

Peraton is hiring a Cyber Defense Incident Responder to support the Special Operations Command Information Technology Enterprise Contract (SITEC) – 3 EOM at MacDill AFB, Florida. The contract provides operations and maintenance services to USSOCOM, its Component Commands, Theater Special Operations Commands, and deployed forces, including network operations, systems and network infrastructure maintenance, end-user and common-device support, configuration and asset management, training, and IMAC services. The Incident Responder is a frontline technical responder responsible for the containment, investigation, eradication, and recovery phases of cyber incidents. The role assesses and validates escalations, conducts tactical containment and digital forensics, investigates and removes malware and persistence mechanisms, coordinates credential purges, and helps restore clean systems. It also involves incident command during high-severity events, collaboration with operational stakeholders and external authorities, and preparation of incident documentation and after-action reports to identify root causes and remediate weaknesses.

Requirements

At least 12 years of experience with a high school diploma; 10 years with an AS/AA degree; 8 years with a BS/BA degree; 6 years with an MS/MA degree; or 3 years with a PhD.
A DoW TS/SCI clearance is required.
Security+ certification is required.
Must be DoW 8140 compliant under Work Role Code 531, Cyber Defense Incident Responder, at Intermediate level or higher.

Responsibilities

Assess and validate inbound escalations; determine the scope, impact, severity, and root cause of security incidents.
Isolate compromised endpoints, sever malicious network connections, and stop unauthorized lateral movement across enclaves.
Conduct host-based and network forensics, including volatile memory analysis, disk imaging, and artifact extraction, to reconstruct adversary timelines.
Remove adversary persistence mechanisms, purge unauthorized credentials, and verify clean system baselines before restoring services.
Maintain chain-of-custody documentation and produce incident summaries and After-Action Reports, including root-cause findings for detection engineering.
Perform static and dynamic triage of malicious binaries, scripts, and dropper files to identify indicators of compromise, persistence methods, and execution behavior.
Identify, catalog, and remove adversary-created persistence artifacts, including unauthorized scheduled tasks, rogue services, modified registry keys, and hidden backdoor accounts.
Prepare reports detailing attack vectors, impact timelines, and defensive breakdowns for mission leadership and stakeholders.
Coordinate with legal counsel, law enforcement, and regulatory compliance authorities to share sanitized forensic evidence and meet reporting timelines.
Design, facilitate, and participate in scenario-based tabletop exercises with leadership, IT operations, and mission stakeholders.
Author and update incident response playbooks for attack scenarios and maintain forensic tools and readiness materials.
Query and analyze SIEM, centralized log, and event-management telemetry to correlate activity into investigative trails.
Aggregate forensic artifacts, authentication logs, and network connection records to build chronological timelines of adversary activity.
Use EDR platforms to query live systems, inspect process trees and parent-child relationships, and identify unauthorized execution artifacts.
Use network traffic analyzers, PCAP tools, and NetFlow/IPFIX logs to investigate external communications, data volumes, and malicious payloads.
Maintain investigative notes, evidence logs, and task tracking in security orchestration and incident case-management systems throughout the incident lifecycle.