SITEC - Cyber Defense Incident Responder - MacDill AFB

Peraton • MacDill AFB, FL

9d • Onsite

About The Position

Peraton is hiring a Cyber Defense Incident Responder to support the Special Operation Command Information Technology Enterprise Contract (SITEC) – 3 EOM at MacDill AFB in Florida. The role supports USSOCOM, its Component Commands, Theater Special Operations Commands, and deployed forces with IT operations and maintenance services.

The Incident Responder is a frontline technical responder responsible for the incident response lifecycle, including containment, investigation, eradication, and recovery. The role assesses and validates escalations, conducts host and network forensics and malware triage, coordinates credential purges, removes adversary persistence, and validates systems before they return to normal operations. It also maintains evidence documentation and chain of custody, develops incident reports and after-action reports, and shares root-cause findings with detection engineering and mission stakeholders.

The position uses security telemetry, SIEM and event management systems, EDR platforms, network traffic analysis, packet capture, and case-management tools to investigate and document incidents. It also supports incident readiness through playbook maintenance and scenario-based tabletop exercises. The position requires a DoW TS/SCI clearance, Security+, and DoW 8140 compliance under Work Role Code 531 at the Intermediate level or higher.

Requirements

• At least 12 years of experience with a high school diploma, 10 years with an associate degree, 8 years with a bachelor's degree, 6 years with a master's degree, or 3 years with a Ph.D.
• DoW TS/SCI clearance.
• Security+ certification.
• DoW 8140 compliance under Work Role Code 531 – Cyber Defense Incident Responder, Intermediate level or higher.

Responsibilities

• Assess and validate inbound escalations, determining the scope, impact, severity, and root cause of live security incidents.
• Isolate compromised endpoints, sever malicious network connections, and stop unauthorized lateral movement across enclaves.
• Conduct host-based and network digital forensics, including volatile memory analysis, disk imaging, artifact extraction, and reconstruction of adversary timelines.
• Eliminate adversary persistence, purge unauthorized credentials, and validate clean system baselines before returning services to normal operations.
• Maintain chain-of-custody documentation, structured investigative notes, evidence logs, and task tracking throughout the incident lifecycle.
• Prepare incident summaries and After-Action Reports detailing attack vectors, timelines, impact, root causes, and defensive breakdowns.
• Provide root-cause findings to the detection engineering team.
• Perform static and dynamic triage of malicious binaries, scripts, and dropper files to identify indicators of compromise, persistence mechanisms, and execution behavior.
• Identify, catalog, and remove adversary-created persistence artifacts, including unauthorized scheduled tasks, rogue services, modified registry keys, and hidden backdoor accounts.
• Coordinate with legal counsel, law enforcement, and regulatory compliance authorities to share sanitized forensic evidence and meet reporting timelines.
• Design, facilitate, and participate in scenario-based tabletop exercises with leadership, IT operations, and mission stakeholders.
• Author and update incident response playbooks for attack scenarios and maintain readiness of forensic tools, including triage scripts and collection images.
• Query and analyze SIEM, centralized log repositories, and event manager telemetry to correlate activities into an investigative trail.
• Aggregate forensic artifacts, authentication logs, and network connection records to construct chronological adversary timelines.
• Use EDR platforms to query live systems, inspect process trees and parent-child relationships, and identify unauthorized execution artifacts.
• Use network traffic analyzers, PCAP inspection tools, and NetFlow/IPFIX logs to trace external communications, quantify data volumes, and inspect malicious payloads.

Benefits

• Medical benefits
• Dental insurance
• Vision insurance
• Life insurance
• Health savings account
• Short- and long-term disability
• Employee Assistance Program (EAP)
• Parental leave
• 401(k)
• Paid time off for vacation
• Company-paid holidays
• Potential eligibility for overtime, shift differential, and a discretionary bonus, depending on the position

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed