Cyber Security Incident Response Analyst – Intermediate

Agile Defense • Fort Huachuca, AZ

2d • $89,000 - $91,000

About The Position

Agile Defense is seeking a skilled and proactive Incident Handler to join its 24x7 security operations team in Ft. Huachuca, Arizona. The role independently identifies, analyzes, and responds to cybersecurity incidents, managing low- to medium-severity incidents through detection, triage, containment, eradication, and recovery. The analyst uses SIEM and EDR platforms, investigates logs and endpoint data, and helps improve defensive playbooks. Experience in an enterprise, military, or Department of War operational environment is strongly desired.

The position requires 2–5 years of experience in incident response, a security operations center, or a closely related cybersecurity role; a bachelor’s degree in cybersecurity or a related field can replace the experience requirement. Candidates must hold one of the listed certifications before starting and must be able to obtain and maintain a Secret security clearance. The posting also identifies a Top Secret SCI clearance under the requisition details.

Requirements

• 2–5 years of experience in dedicated incident response, a security operations center, or a closely related cybersecurity role; a bachelor’s degree in cybersecurity or a related field can replace the experience requirement.
• Strong understanding of the incident response lifecycle, such as the NIST framework, common attack vectors, and foundational network and endpoint forensics.
• Hands-on experience investigating and responding to threats using SIEM and EDR platforms.
• Strong analytical and problem-solving abilities, including the capacity to work independently on incidents of varying complexity.
• Excellent communication skills, including the ability to write clear, concise incident reports and collaborate with technical teams.
• Ability to work in a fast-paced 24x7 security operations environment and manage and prioritize multiple incidents.
• Must be able to obtain and maintain a Secret security clearance.
• Must possess one of the listed certifications before the start date: GMON, GRID, CEH, Cloud+, CySA+, GSEC, PenTest+, Security+, or SSCP. The qualifications section separately lists CompTIA Security+, CEH, and CySA+.

Nice To Haves

• Experience in an enterprise, military, or Department of War operational environment is strongly desired.
• Familiarity with U.S. military policies, procedures, and organizational structures.
• Foundational understanding of cybersecurity controls and the importance of adhering to security policies in a professional environment.
• Basic experience reviewing network activity logs and understanding common network protocols such as DNS, HTTP, and SMB.
• Familiarity with reviewing security events from standard endpoint platforms, such as antivirus and host firewalls.
• Exposure to or academic experience with a SIEM platform such as Splunk, Kibana, or Sentinel; MDE EDR or KQL; ServiceNow or another ticketing system; or the Linux command line.

Responsibilities

• Independently manage the lifecycle of low- to medium-severity security incidents, including monitoring and triaging SIEM and EDR alerts, containment, eradication, and recovery.
• Analyze logs from network devices, servers, and applications, as well as endpoint data from EDR platforms, to investigate security events.
• Use security tools to contain active threats, such as isolating endpoints or blocking malicious IP addresses, and execute and verify remediation steps.
• Execute incident response playbooks and provide feedback to senior handlers to improve procedures.
• Prepare incident reports describing event timelines, investigative steps, root cause analysis, and resolution actions.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level