Cyber Incident Response Analyst

CACI International•Hampton, VA

3d•$75,200 - $158,100•Onsite

About The Position

Our client is seeking a highly motivated Incident Response Analyst that will join the Cyber Security Incident Response Team (IRT) supporting the AF DCGS program located onsite at Langley AFB, Va. The ideal candidate will have a solid understanding of Windows, Linux, and Cloud environments, networking concepts, and system administration fundamentals. They should also possess hands-on experience with SIEMs, or other cyber tools utilized for detection and analysis. In addition, the candidate must demonstrate familiarity with the incident response (IR) process, including the ability to apply established procedures during investigations, escalate findings appropriately, and provide clear actionable reporting to appropriate stakeholders and/or affected teams with minimal supervision.

Requirements

Active Top Secret/SCI security clearance.
Bachelor’s degree in IT Technology, Computer Science, or related field with 5+ years of experience. Degree may be substituted with equivalent experience.
DOD 8140 (8570) IAT Level II (Security+ or equivalent).
In-depth understanding of the Incident Response lifecycle
Familiarity with cyber security tools and procedures
Strong problem-solving and analytical skills
Knowledge of security best practices and standards, including NIST, ISO, and SOC operations.
Effective written and verbal communication skills for documentation and collaboration
Willing and able to work in a shift-based environment, including weekends and holidays, as part of our 24/7 operations.

Nice To Haves

AF DCGS experience.
Proficiency in using the Elastic Stack (Elasticsearch, Logstash, Kibana)
Four to seven years of intelligence network communications or Systems Administration experience across Windows and Linux platforms
Experience with AWS and/or other cloud security platforms
Background as an ISSO, including STIG/SCAP and vulnerability management
Familiarity with tools such as Tanium, Trellix, Eracent and ACAS
Basic scripting skills (Python, PowerShell, Bash)
Holds industry-recognized certifications such as CySA+, PenTest+, GCIH, or equivalent credentials.

Responsibilities

Lead and assist in incident response investigations through all phases (detection, containment, eradication, recovery, lessons learned) to ensure the confidentiality, integrity, and availability of the OA DCGS weapon system.
Utilize ELK/Elastic Stack to perform log analysis, threat detection, and investigations; Create and maintain security incident reports and dashboards.
Escalate and document internal/external security incidents through appropriate ticketing and reporting processing
Design, implement, and maintain cybersecurity Standard Operating Procedures (SOPs) and incident response playbooks
Maintain documentation of Incident Response (IR) processes and case notes; Ensure security testing and evaluations are completed and properly documented.
Support proactive threat hunting and vulnerability assessments
Analyze and correlate logs from varied data sources to identify patterns and anomalies
Apply knowledge of Zero-Day vulnerabilities and Common Vulnerabilities and Exposures (CVEs) to incident handling and remediation
Collaborate with cross-functional teams and external stakeholders as needed
Provide guidance for securing information systems and support cyber vulnerability penetration assessments.