SITEC - Cyber Defense Incident Responder - MacDill AFB

Peraton•Tampa, FL

5d•$66,000 - $106,000•Onsite

About The Position

Peraton is seeking a Cyber Defense Incident Responder to support the Special Operation Command Information Technology Enterprise Contract (SITEC) 3 Enterprise Operations and Maintenance Task Order. The position is located at MacDill AFB in Florida and supports USSOCOM, its Component Commands, Theater Special Operations Commands, and deployed forces with operations and maintenance services. The Incident Responder is a frontline technical responder responsible for end-to-end cyber incident containment, investigation, eradication, and recovery. The role responds to alerts and security anomalies by containing threats, conducting host and network forensics, triaging malware, coordinating credential purges, and validating systems before services return to normal. During high-severity incidents, the responder establishes incident command and coordinates with operational stakeholders and relevant external authorities. The position also produces formal incident summaries and After-Action Reports, documents evidence and chain of custody, supports detection engineering through root-cause findings, maintains incident response playbooks and forensic readiness, participates in tabletop exercises, and analyzes security telemetry to reconstruct adversary activity.

Requirements

Minimum experience varies by education: 4 years with a high school diploma, 2 years with an AS/AA degree, or 0 years with a BS degree.
A DoW TS/SCI clearance is required.
Security+ certification is required.
Must be DoW 8140 compliant under Work Role Code 531, Cyber Defense Incident Responder, at Basic level or higher.

Responsibilities

Assess and validate inbound escalations, determining the scope, impact, severity, and root cause of security incidents.
Isolate compromised endpoints, sever malicious network connections, and stop unauthorized lateral movement.
Conduct host-based and network digital forensics, including volatile memory analysis, disk imaging, and artifact extraction.
Eliminate adversary persistence mechanisms, purge unauthorized credentials, and verify clean system baselines before restoring services.
Maintain chain-of-custody documentation and produce incident summaries and After-Action Reports with root-cause findings.
Perform static and dynamic triage of malicious binaries, scripts, and dropper files to identify indicators of compromise, persistence mechanisms, and execution behavior.
Identify, catalog, and remove adversary-created persistence artifacts, including unauthorized scheduled tasks, rogue services, modified registry keys, and hidden backdoor accounts.
Document attack vectors, impact timelines, and defensive breakdowns for mission leadership and stakeholders.
Coordinate with legal counsel, law enforcement, and regulatory compliance authorities to share sanitized forensic evidence and meet reporting timelines.
Design, facilitate, and participate in scenario-based tabletop exercises with leadership, IT operations, and mission stakeholders.
Author and update incident response playbooks for attack scenarios such as ransomware, supply chain compromise, and business email compromise, and maintain forensic tools and collection images.
Query and analyze SIEM, centralized log repositories, and event manager telemetry to correlate activity into investigative trails.
Aggregate forensic artifacts, authentication logs, and network connection records to construct timelines of adversary access, execution, and lateral movement.
Use EDR platforms to query live systems, inspect process trees and parent-child relationships, and identify unauthorized execution artifacts.
Use network traffic analyzers, PCAP inspection tools, and NetFlow/IPFIX logs to trace communications, quantify data volumes, and inspect malicious payloads.
Maintain investigative notes, evidence logs, and task tracking in security orchestration and incident case management systems.

Benefits

Medical insurance
Dental insurance
Vision insurance
Life insurance
Health savings account
Short- and long-term disability
Employee Assistance Program (EAP)
Parental leave
401(k)
Paid time off (PTO) for vacation
Company-paid holidays
Potential eligibility for overtime, shift differential, and a discretionary bonus