Cybersecurity Incident Response Analyst

Booz Allen Hamilton•Washington, DC

2d•$86,800 - $198,000

About The Position

Apply cybersecurity knowledge to monitor, analyze, detect, and respond to cyber events and incidents in information systems and networks. Contribute to integrated cyber defense and provide operational cybersecurity services, including intrusion detection and prevention, situational awareness of network intrusions, security events and data spillage, and incident response actions. Work on complex, high-impact problems and develop creative solutions and recommendations. Coordinate incident response activities and professional communications across stakeholders. Collaborate with security teams to develop, tune, automate, and enhance network- and host-based security devices; support the SOC in responding to client cyber intrusions; conduct extensive network and host triage; maintain chain of custody; analyze documentation and reports; and perform remediation as needed. Applicants must hold a Secret clearance and may be subject to a security investigation and eligibility requirements for access to classified information. The position offers a projected annual compensation range of $86,800 to $198,000. Booz Allen describes benefits including health, life, disability, financial and retirement benefits, paid leave, professional development, tuition assistance, work-life programs, dependent care, and recognition awards. Eligibility for benefit programs depends on hours worked. The posting states it will close within 90 days of its posting date.

Requirements

At least 5 years of experience in cybersecurity or information technology disciplines.
At least 3 years of experience in one or more of the following: APT hunting, penetration testing, digital forensics, malware reverse engineering, SOC operations, or incident response.
Experience with incident response tools such as SentinelOne, Splunk, or Microsoft Defender.
Ability to adapt communications styles and messaging for professionals at all levels of leadership.
Secret clearance.
Bachelor's degree.
One of the following certifications: OSCP, CCNA-Security, CySA+, GCIH, GICSP, or PenTest+.

Nice To Haves

Ability to detect and search for MITRE ATT&CK TTPs and common attacker methodologies using PCAP data and tools such as Wireshark.
Ability to analyze SIEM alerts to identify security issues for investigation and remediation.
Ability to profile and track malicious actors in coordination with threat intelligence support teams.
Ability to review and analyze security log files from cloud, network, endpoint, or ICAM sources.
Ability to work independently, take initiative, and handle multiple tasks concurrently.
TS/SCI clearance.

Responsibilities

Monitor, analyze, detect, and respond to cyber events and incidents in information systems and networks.
Contribute to integrated cyber defense and operational services, including intrusion detection and prevention, situational awareness, and incident response.
Handle major, high-impact incidents and generate clear, concise recommendations.
Coordinate incident response activities and professional communications across stakeholders.
Work with security teams to develop, tune, automate, and enhance network- and host-based security devices.
Support the Security Operations Center in managing responses to client cyber intrusions.
Perform extensive network and host triage and maintain strict chain of custody.
Analyze documentation and reports, and perform remediation as required.