Cyber Security Incident Response Analyst – Intermediate

Agile Defense • Fort Huachuca, AZ

4h • Onsite

About The Position

Agile Defense is hiring an intermediate Incident Handler to join its 24x7 security operations team at Ft. Huachuca, Arizona. The role independently identifies, analyzes, and responds to cybersecurity incidents, managing low- to medium-severity incidents through detection, containment, eradication, recovery, and resolution. The analyst uses SIEM and EDR tools, investigates logs and endpoint data, executes incident response playbooks, and helps improve procedures by providing feedback to senior handlers. Experience in an enterprise, military, or Department of War operational environment is strongly desired. The position requires a Top Secret SCI clearance and a listed certification before the start date; the qualifications also state that the candidate must be able to obtain and maintain a Secret security clearance.

Requirements

• At least 2–5 years of experience in incident response, a security operations center, or a closely related cybersecurity role; a bachelor’s degree in cybersecurity or a related field can replace experience requirements.
• Strong understanding of the incident response lifecycle, such as the NIST framework, common attack vectors, and foundational network and endpoint forensics.
• Hands-on experience investigating and responding to threats using SIEM and EDR platforms.
• Analytical and problem-solving abilities, including the ability to work independently on incidents of varying complexity.
• Excellent communication skills, including writing clear and concise incident reports and collaborating with technical teams.
• Ability to work in a fast-paced 24x7 security operations environment and manage and prioritize multiple incidents.
• Must be able to obtain and maintain a Secret security clearance; the listing also specifies Top Secret SCI clearance.
• Must possess one of the following certifications before the start date: CompTIA Security+, Certified Ethical Hacker (CEH), or CySA+.

Nice To Haves

• Experience in an enterprise, military, or Department of War operational environment is strongly desired.
• Familiarity with U.S. military policies, procedures, and organizational structures.
• Foundational understanding of cybersecurity controls and adherence to security policies.
• Basic experience reviewing network activity logs and understanding common protocols such as DNS, HTTP, and SMB.
• Familiarity with reviewing security events from standard endpoint platforms, such as antivirus and host firewalls.
• Exposure to or academic experience with a SIEM platform such as Splunk, Kibana, or Sentinel; Microsoft Defender for Endpoint and/or KQL; ServiceNow or another ticketing system; or the Linux command line.

Responsibilities

• Independently manage the lifecycle of low- to medium-severity incidents, including monitoring and triaging SIEM and EDR alerts, containment, eradication, and recovery.
• Analyze logs from network devices, servers, and applications, along with endpoint data from EDR platforms, to investigate security events.
• Use security tools to contain active threats, including isolating endpoints or blocking malicious IP addresses.
• Execute and verify remediation steps to resolve incidents.
• Execute incident response playbooks and provide feedback to senior handlers to improve procedures.
• Prepare clear incident reports documenting event timelines, investigative steps, root cause analysis, and resolution actions.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level