Incident Handler - Senior

Peraton•Fort Huachuca, AZ

About The Position

Peraton is seeking a Senior Cyber Incident Response Analyst to conduct technical investigations into cybersecurity incidents and manage the incident lifecycle from detection and triage through containment, eradication, recovery, and post-incident review. The role coordinates response activities with GCC teams, supported unit commanders, NETCOM, and ARCYBER, and works with the forensics SME to investigate incidents and analyze digital evidence. The analyst documents incident scope, impact, root cause, and remediation actions; maintains complete case records; and develops response playbooks, lessons learned, and process improvements supporting the GCC Cybersecurity Service Provider (CSSP) mission. Incident response activities must follow NIST SP 800-61 Rev. 3 and Army procedures.

Requirements

Meet the stated experience requirement based on education: 2 years with a bachelor's degree, 4 years with an associate degree, 0 years with a master's degree, or 6 years with no degree.
Hold DoD 8140 DCWF 531 Advanced certification before the start date.
Ability to obtain a DoD Secret clearance.
Experience with the ServiceNow Security Operations (SecOps) module for incident tracking and SLA management.
Proficiency with Elastic Stack for SIEM alert triage, event correlation, and incident timeline reconstruction.
Working knowledge of NIST SP 800-61 Rev. 3 and DoD/Army incident response policy frameworks.
Experience developing and exercising incident response playbooks for common cyberattack scenarios in a DoD environment.
Familiarity with digital forensics tools and techniques for evidence collection, chain of custody, and artifact analysis.
Experience operating in a 24/7 CSSP or SOC environment supporting classified Army or DoW networks.

Nice To Haves

Active DoD Secret clearance.

Responsibilities

Manage the full cyber incident lifecycle, from initial detection and triage through containment, eradication, recovery, and post-incident review, in accordance with NIST SP 800-61 Rev. 3 and Army incident response procedures.
Coordinate with internal GCC teams, supported unit commanders, NETCOM, and ARCYBER during active incidents; provide incident status updates and ensure timely, accurate communication.
Produce analysis reports documenting the timeline, scope, impact, root cause, and remediation actions for each incident.
Maintain accurate incident tracking records, including case data, evidence artifacts, analyst notes, and closure documentation, in accordance with GCC quality standards and audit requirements.
Conduct post-incident reviews and lessons-learned sessions, identify process gaps, detection failures, and response inefficiencies, and translate findings into actionable improvements for the GCC CSSP.
Mentor associate-level staff and perform quality assurance reviews of team output.
Develop, maintain, and exercise incident response playbooks for scenarios such as ransomware, phishing, credential theft, and insider threat, keeping procedures current with threats, Army policy, and mission requirements.