Cyber Incident Response Analyst

Allied Consultants, Inc.•San Antonio, TX

1d•Onsite

About The Position

Texas GovLink, Inc. is an Austin-based firm which has been a leading provider of technical and business professionals to clients in Texas. We are currently seeking an experienced Cyber Incident Response Analyst to be a key resource on a technical services team. Texas GovLink offers its family of consultants excellent rates, a local support staff, and an attractive benefits package which includes medical insurance (TGL shares a percentage of the cost), life insurance, a matching 401(k) plan and a cafeteria plan. Candidates selected for interview will be required to undergo criminal background checks and may be required to complete a drug screen in accordance with Federal and State Law. Offers of Employment are contingent on a successful background check. Texas GovLink is an equal opportunities employer.

Requirements

5 years of advanced host‑based forensics across Windows and Linux, including memory, disk, and malware analysis, using telemetry from NetWitness, Gravwell, Google SecOps, and Corelight to validate findings and reconstruct attacker activity.
5 years of ability to correlate host, network, and intelligence data from CrowdStrike, SentinelOne, Microsoft Sentinel, Corelight, and NetWitness to build complete incident timelines.
5 years of experience producing high‑quality incident reports and executive summaries using evidence collected from Gravwell, NetWitness, Corelight, and case management workflows.
4 years of strong understanding of adversary TTPs, intrusion kill chains, and threat hunting methodologies using packet‑level and log‑level data from but not limited to Corelight, NetWitness, and CRIBL pipelines.
3 years of Incident Commander experience
1 year of experience supporting SLTT or critical infrastructure environments, including multi‑tenant IR operations and cross‑agency coordination.

Nice To Haves

5 years of proficiency with threat intelligence platforms, including Recorded Future, ThreatMon, GreyNoise, Google Threat Intelligence, VirusTotal, and Mandiant, to enrich investigations, validate indicators, and map activity to MITRE ATT&CK.
5 years of hands‑on experience using Cyware CSAP for incident orchestration, automated enrichment, case creation, and workflow execution across SIEM, IPS, EDR, and ticketing systems.
4 years of Security Certifications Preferred (CISSP, CIH, Sec+)

Responsibilities

Perform advanced incident response across Windows and Linux environments, including triage, containment, eradication, and recovery.
Conduct host-based forensics, including log analysis, memory capture, file system review, and malware behavior analysis.
Serve as Incident Commander during cybersecurity events, coordinating actions, documenting decisions, and communicating with leadership and affected agencies.
Analyze adversary Tactics, Techniques, and Procedures (TTPs) and map findings to MITRE ATT&CK.
Review and validate alerts from SIEM, IDS/IPS, EDR, and network monitoring tools.
Produce incident reports, timelines, and executive summaries for statewide stakeholders.
Support multi-agency response operations, including SLTT partners and critical infrastructure entities.
Provide recommendations for detection improvements, hardening, and long-term mitigation.
Participate in post-incident reviews, lessons learned, and playbook updates.
Maintain readiness for 24x7 response through on-call rotation or surge support.