Cybersecurity Incident Response Analyst

Booz Allen Hamilton • Huntsville, DC

1h

About The Position

Apply an understanding of monitoring, analyzing, detecting, and responding to cyber events and incidents in information systems and networks. Contribute to an integrated, dynamic cyber defense and leverage cybersecurity solutions to deliver cybersecurity operational services, including intrusion detection and prevention, situational awareness of network intrusions, security events and data spillage, and incident response actions. Contribute to the development of innovative principles and ideas, work on unusually complex problems, and provide highly creative solutions. Handle major, high-impact incidents, generate clear and concise recommendations, and coordinate activities and professional communications across a range of stakeholders.

Work closely with security teams to develop, tune, automate, and enhance network- and host-based security devices. Support the Security Operations Center (SOC) in managing responses to client cyber intrusions; perform extensive network and host triage; maintain strict chain of custody; analyze documentation and reports; and perform remediation as required.

Requirements

• At least 5 years of experience in cybersecurity or information technology disciplines.
• At least 3 years of experience with APT hunting, penetration testing, digital forensics, malware reverse engineering, SOC operations, or incident response.
• Experience with incident response tools such as SentinelOne, Splunk, or Microsoft Defender.
• Ability to adapt communications styles and messaging for professionals at all levels of leadership.
• Secret clearance.
• Bachelor's degree.
• OSCP, CCNA-Security, CySA+, GCIH, GICSP, or PenTest+ certification.

Nice To Haves

• Ability to detect and search for MITRE ATT&CK TTPs and common attacker methodologies using PCAP data with tools such as Wireshark.
• Ability to analyze SIEM alerts to identify security issues for investigation and remediation.
• Ability to profile and track malicious actors that pose a threat in coordination with threat intelligence support teams.
• Ability to review and analyze security log files from various sources, including cloud, network, endpoint, or ICAM.
• Ability to be self-driven, work independently, and handle multiple tasks concurrently.
• TS/SCI clearance.

Responsibilities

• Monitor, analyze, detect, and respond to cyber events and incidents in information systems and networks.
• Contribute to integrated cyber defense and deliver cybersecurity operational services, including intrusion detection and prevention, situational awareness of network intrusions, security events and data spillage, and incident response actions.
• Handle major, high-impact incidents and provide clear, concise recommendations.
• Coordinate activities and professional communications across a range of stakeholders.
• Work with security teams to develop, tune, automate, and enhance network- and host-based security devices.
• Support the SOC in managing responses to client cyber intrusions.
• Perform network and host triage and maintain strict chain of custody.
• Analyze documentation and reports, and perform remediation as required.
• Contribute innovative ideas and develop creative solutions to unusually complex problems.

Benefits

• Health, life, and disability benefits.
• Financial and retirement benefits.
• Paid leave.
• Professional development.
• Tuition assistance.
• Work-life programs.
• Dependent care.
• Recognition awards for exceptional performance and demonstration of company values.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level