SITEC - Cyber Defense Incident Responder - MacDill AFB

Peraton•MacDill AFB, FL

2d•Onsite

About The Position

Peraton is hiring a Cyber Defense Incident Responder to support the Special Operation Command Information Technology Enterprise Contract (SITEC) – 3 EOM at MacDill AFB in Florida. The contract provides USSOCOM, its Component Commands, Theater Special Operations Commands, and deployed forces with operations and maintenance services, including network operations, infrastructure maintenance, end-user and common-device support, configuration and asset management, training, and IMAC services. The supported missions operate around the globe 24x7x365. The role is a frontline technical responder responsible for the end-to-end cyber incident response lifecycle, including containment, investigation, eradication, and recovery. The responder assesses and validates escalations, performs host and network forensics and malware triage, removes adversary persistence, coordinates credential purges, and validates clean system baselines. The role also establishes incident command during high-severity crises, coordinates with stakeholders and authorities, maintains evidence and chain-of-custody records, and produces incident reports and root-cause findings. Additional work includes analyzing security telemetry, using EDR and network analysis tools, maintaining incident response playbooks and forensic readiness, and participating in scenario-based exercises.

Requirements

At least 4 years of experience with a high school diploma, 2 years with an associate degree, or 0 years with a bachelor's degree.
DoW TS/SCI clearance.
CompTIA Security+ certification.
DoW 8140 compliance under Work Role Code 531 – Cyber Defense Incident Responder, Basic level or higher.

Responsibilities

Assess and validate inbound escalations, determining the scope, impact, severity, and root cause of active security incidents.
Isolate compromised endpoints, sever malicious network connections, and stop unauthorized lateral movement.
Conduct host-based and network digital forensics, including volatile memory analysis, disk imaging, live response, and artifact extraction.
Remove adversary persistence mechanisms, purge unauthorized credentials, and validate clean system baselines before returning services to normal operations.
Maintain strict chain-of-custody documentation and produce incident summaries and After-Action Reports detailing attack vectors, timelines, impact, and defensive breakdowns.
Provide root-cause findings to the detection engineering team.
Perform static and dynamic triage of malicious binaries, scripts, and dropper files to identify indicators of compromise, persistence mechanisms, and execution behavior.
Identify, catalog, and remove adversary-created artifacts, including unauthorized scheduled tasks, rogue services, modified registry keys, and hidden backdoor accounts.
Coordinate with legal counsel, law enforcement, and regulatory compliance authorities to share sanitized forensic evidence and meet reporting timelines.
Design, facilitate, and participate in scenario-based tabletop exercises with leadership, IT operations, and mission stakeholders.
Author and update incident response playbooks for attack scenarios such as ransomware, supply chain compromise, and business email compromise.
Maintain forensic toolkit readiness, including triage scripts and collection images.
Query and analyze SIEM, centralized log repositories, and event manager telemetry to correlate activity into investigative trails.
Aggregate forensic artifacts, authentication logs, and network connection records to construct chronological timelines of adversary activity.
Use EDR platforms to run live system queries, inspect process trees and parent-child relationships, and identify unauthorized execution artifacts.
Use network traffic analyzers, PCAP tools, and NetFlow/IPFIX logs to trace external communications, quantify data volume, and inspect malicious payloads.
Maintain investigative notes, evidence logs, and task tracking in security orchestration and incident case management systems.
Establish incident command during high-severity crises and interface with operational stakeholders and regulatory bodies.

Benefits

Medical benefits
Dental insurance
Vision insurance
Life insurance
Health savings account
Short- and long-term disability
Employee Assistance Program (EAP)
Parental leave
401(k)
Paid time off for vacation
Company-paid holidays
Potential eligibility for overtime, shift differential, and a discretionary bonus, depending on the position