Cyber Security Incident Response Analysis II - Digital Forensics and Incident Response

OSC Global•Richland, WA

4h•$80,000 - $129,000

About The Position

This position supports the cybersecurity program at the U.S. Department of Energy Hanford Site in Richland, Washington. The Analyst detects, investigates, and responds to cybersecurity incidents across a FISMA Moderate IT enterprise and supporting industrial control system (ICS) and operational technology (OT) environments governed by DOE Order 205.1C and NIST SP 800-53 Rev. 5. Working with increasing independence under senior analysts’ guidance, the Analyst handles assigned incidents from triage through closure, conducts host, memory, network, and cloud forensic analysis, and contributes to detection content, playbooks, and post-incident improvements. The position is intended for analysts with foundational DFIR experience who are ready to take ownership of moderately complex investigations. The Analyst must be able to participate in an after-hours on-call rotation and report on-site to the Hanford Site as needed during incident response. The position requires U.S. citizenship, residence within the United States, a pre-employment background check and drug screening, REAL ID-compliant identification at hire, and the ability to obtain and maintain a DOE HSPD-12 PIV credential following a successful federal background investigation. Work cannot be performed from outside the United States. The listed pay range is $80,000 to $129,000. Eligible employees receive paid holidays, paid time off, a 401(k) with employer match, dental, vision, health insurance through the Federal Employee Health Benefits program, and life and disability benefits.

Requirements

Two or more years of cybersecurity experience, including hands-on incident response, digital forensics, or SOC experience.
Working knowledge of federal incident response and forensics requirements, including NIST SP 800-61 Rev. 3, NIST SP 800-86, NIST SP 800-53 Rev. 5 IR and AU control families, and DOE O 205.1C.
Hands-on experience with forensic and triage tools such as Magnet AXIOM, FTK, or EnCase.
Experience with SIEM, EDR, and network analysis tools such as Splunk, Microsoft Sentinel, CrowdStrike Falcon, Microsoft Defender for Endpoint, Zeek, or Wireshark.
Working knowledge of Windows and Linux internals and forensic artifacts, Active Directory, network protocols, and common malware behavior.
Ability to map adversary tactics, techniques, and procedures to MITRE ATT&CK and translate findings into detection and containment actions.
Basic scripting ability, such as PowerShell or Python, to automate collection, parsing, and analysis tasks.
Strong analytical, troubleshooting, and problem-solving skills, with attention to detail and accurate documentation.
Excellent written and verbal communication skills, including the ability to explain technical findings to non-technical audiences.
Ability to remain composed, set and manage priorities, and work cooperatively in a team during time-sensitive, high-pressure incidents.
High degree of sensitivity regarding confidential information and sensitive investigations.
BA/BS degree in Cyber Security, Computer Science, Digital Forensics, Information Technology, or a related field, and two or more years of relevant experience; an equivalent combination of education, training, and experience is accepted.
Ability to participate in an after-hours on-call rotation and report on-site to the Hanford Site in Richland, Washington as needed during incident response.
Ability to pass a pre-employment background check and drug screening.
Must have REAL ID Act-compliant identification at time of hire.
Must be able to obtain and maintain a DOE HSPD-12 PIV credential, requiring a successful federal background investigation.
U.S. citizenship is required.
Must reside within the United States; work cannot be performed from outside the United States.
Must comply with federal controlled-substance regulations, including the employer's cannabis prohibition and pre-employment cannabis screening.

Nice To Haves

CompTIA Security+, GIAC GSEC, or ISC2 SSCP certification; Splunk Core Certified User certification is also preferred.
ISC2 Certified in Cybersecurity (CC) or CompTIA Network+ certification.
Completion of SOC analyst training such as Splunk Fundamentals.
Experience supporting incident response in DOE or other federal FISMA-regulated environments.
Experience with cloud incident response involving Microsoft 365, Azure, or Entra ID; introductory malware analysis; or SOAR playbook development.

Responsibilities

Monitor, triage, and analyze alerts and events from SIEM, EDR, NDR, SOAR, email security, and other enterprise security platforms; validate findings and escalate according to established procedures.
Handle assigned incidents from detection through closure, including scoping, containment, eradication, and recovery recommendations, in alignment with NIST SP 800-61 Rev. 3, the CISA federal incident response playbook, and the site incident response plan.
Conduct forensic acquisition and analysis of endpoints, servers, memory, logs, and network traffic to determine root cause, scope, and impact.
Investigate account compromise, business email compromise, and data exposure using identity and cloud audit sources, including Microsoft 365 Unified Audit Log and Entra ID sign-in and audit logs.
Preserve evidence and maintain chain of custody in accordance with NIST SP 800-86 and site procedures, supporting potential referral to the DOE Office of Inspector General, law enforcement, or legal counsel.
Document incident activity in the case management system; prepare incident reports, timelines, and root cause analyses; and support required reporting to DOE, including the Integrated Joint Cybersecurity Coordination Center (iJC3).
Conduct hypothesis-driven threat hunts informed by threat intelligence and MITRE ATT&CK, including ATT&CK for ICS, and conduct targeted hunts in response to CISA Emergency Directives, Binding Operational Directives, and DOE threat notifications.
Develop and tune detection content and indicators of compromise, including SPL/KQL queries and Sigma and YARA rules, based on investigation findings and emerging threats.
Coordinate with ICS/OT engineering staff during incidents affecting operational environments, using non-intrusive collection methods that protect safety and operational availability.
Monitor threat intelligence from DOE, CISA, and other sources; distribute threat advisories and incident summaries to customers and leadership.
Contribute to incident response playbooks, standard operating procedures, and the incident response plan; participate in exercises and after-action reviews; and track corrective actions to closure, including POA&M entries where applicable.
Support cybersecurity audits, assessments, and data calls related to incident response, audit logging, including OMB M-21-31 event logging requirements, and continuous monitoring.
Support operation and maintenance of forensic and incident response tools.
Share knowledge with and assist in training Level I analysts and interns.
Perform other duties as appropriate and assigned.