Cyber Security Incident Response Analysis II - Digital Forensics and Incident Response

OSC Global • Richland, WA

8d • Onsite

About The Position

This position supports the cybersecurity program at the U.S. Department of Energy Hanford Site in Richland, Washington. The Analyst detects, investigates, and responds to cybersecurity incidents across a FISMA Moderate IT enterprise and supporting industrial control system (ICS) and operational technology (OT) environments governed by DOE Order 205.1C and NIST SP 800-53 Rev. 5. Working with increasing independence under senior analysts’ guidance, the Analyst manages assigned incidents from triage through closure, conducts host, memory, network, and cloud forensic analysis, and contributes to detection content, playbooks, and post-incident improvements. The role is intended for analysts with foundational DFIR experience ready to take ownership of investigations of moderate complexity.

The position requires participation in an after-hours on-call rotation and the ability to report onsite to the Hanford Site as needed during incident response. Candidates must be U.S. citizens, reside within the United States, pass pre-employment screening, and be able to obtain and maintain a DOE access authorization and HSPD-12 PIV credential. The role requires a relevant bachelor’s degree and at least two years of relevant experience, or an equivalent combination of education, training, and experience.

Requirements

• At least two years of cybersecurity experience, including hands-on incident response, digital forensics, or security operations center experience.
• Working knowledge of federal incident response and forensics requirements, including NIST SP 800-61 Rev. 3, NIST SP 800-86, NIST SP 800-53 Rev. 5 (IR and AU control families), and DOE O 205.1C.
• Hands-on experience with forensic and triage tools such as Magnet AXIOM, FTK, or EnCase.
• Experience with SIEM, EDR, and network analysis tools such as Splunk, Microsoft Sentinel, CrowdStrike Falcon, Microsoft Defender for Endpoint, Zeek, or Wireshark.
• Working knowledge of Windows and Linux internals and forensic artifacts, Active Directory, network protocols, and common malware behavior.
• Ability to map adversary tactics, techniques, and procedures to MITRE ATT&CK and translate findings into detection and containment actions.
• Basic scripting ability, such as PowerShell or Python, to automate collection, parsing, and analysis tasks.
• Strong analytical, troubleshooting, and problem-solving skills, with attention to detail and accurate documentation.
• Excellent written and verbal communication skills, including the ability to explain technical findings to non-technical audiences.
• Ability to remain composed, manage priorities, and work cooperatively in a team during time-sensitive, high-pressure incidents.
• High degree of sensitivity regarding confidential information and sensitive investigations.
• Bachelor’s degree in Cyber Security, Computer Science, Digital Forensics, Information Technology, or a related field, and at least two years of relevant experience, or an equivalent combination of education, training, and experience.
• Ability to participate in an after-hours on-call rotation and report onsite to the Hanford Site in Richland, Washington, as needed during incident response.
• Ability to pass a pre-employment background check and drug screening.
• Must have identification compliant with the REAL ID Act at time of hire.
• Must be able to obtain and maintain DOE access authorization (HSPD-12 PIV credential), requiring a successful federal background investigation.
• U.S. citizenship required.
• Must reside within the United States; work cannot be performed from outside the United States.

Nice To Haves

• CompTIA Security+, GIAC GSEC, or ISC2 SSCP certification; Splunk Core Certified User certification is also preferred.
• ISC2 Certified in Cybersecurity (CC) or CompTIA Network+ is valued.
• Completion of SOC analyst training, such as Splunk Fundamentals.
• Experience supporting incident response in DOE or other federal FISMA-regulated environments.
• Experience with cloud incident response (Microsoft 365, Azure, or Entra ID), introductory malware analysis, or SOAR playbook development.

Responsibilities

• Monitor, triage, and analyze security alerts and events from SIEM, EDR, NDR, SOAR, email security, and other enterprise security platforms; validate findings and escalate according to established procedures.
• Handle assigned incidents from detection through closure, including scoping, containment, eradication, and recovery recommendations, in alignment with applicable incident response guidance and site plans.
• Acquire and analyze forensic evidence from endpoints, servers, memory, logs, and network traffic to determine incident root cause, scope, and impact.
• Investigate account compromise, business email compromise, and data exposure using identity and cloud audit sources, including Microsoft 365 Unified Audit Log and Entra ID sign-in and audit logs.
• Preserve evidence and maintain chain of custody in accordance with NIST SP 800-86 and site procedures, supporting potential referral to the DOE Office of Inspector General, law enforcement, or legal counsel.
• Document incident activity in the case management system; prepare incident reports, timelines, and root cause analyses; and support required DOE incident reporting timelines.
• Conduct hypothesis-driven threat hunts using threat intelligence and MITRE ATT&CK, including ATT&CK for ICS, and conduct targeted hunts in response to CISA directives and DOE threat notifications.
• Develop and tune detection content and indicators of compromise, including SPL/KQL queries and Sigma and YARA rules, based on investigation findings and emerging threats.
• Coordinate with ICS/OT engineering staff during incidents affecting operational environments, using non-intrusive collection methods that protect safety and operational availability.
• Monitor threat intelligence from DOE, CISA, and other sources; distribute threat advisories and incident summaries to customers and leadership.
• Contribute to incident response playbooks, standard operating procedures, and the incident response plan; participate in exercises and after-action reviews; and track corrective actions to closure, including POA&M entries where applicable.
• Support cybersecurity audits, assessments, and data calls related to incident response, audit logging, and continuous monitoring.
• Support operation and maintenance of forensic and incident response tools.
• Share knowledge with and assist in training Level I analysts and interns.
• Perform other duties as appropriate and as assigned.

Benefits

• Paid holidays
• Paid time off
• 401(k) with employer match
• Dental insurance
• Vision insurance
• Health insurance plans through the Federal Employee Health Benefits (FEHB) program
• Life benefits
• Disability benefits

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level