Incident Handler - Senior

Peraton•Fort Huachuca, AZ

1d•$80,000 - $128,000

About The Position

Peraton is seeking a Senior Cyber Incident Response Analyst to conduct technical investigations into cybersecurity incidents and manage the full incident lifecycle, from detection and triage through containment, eradication, recovery, and post-incident review. The role coordinates response activities with GCC teams, supported unit commanders, NETCOM, and ARCYBER; works with forensics specialists to investigate incidents and analyze digital evidence; documents incident scope, impact, root cause, and remediation; and maintains complete case records. The analyst also develops response playbooks, captures lessons learned, and drives process improvements in support of the GCC Cybersecurity Service Provider (CSSP) mission. The position provides technical leadership through mentorship of associate-level staff and quality assurance reviews. Incident response must follow NIST SP 800-61 Rev. 3 and Army procedures. The role supports classified Army or DoW networks in a 24/7 CSSP or SOC environment. Candidates must be able to obtain a DoD TS/SCI clearance, but a clearance is required before starting. An active DoD TS/SCI clearance is preferred.

Requirements

Meet one of the stated experience and education combinations: 5 years with a bachelor's degree; 7 years with an associate degree; 3 years with a master's degree; or 9 years with no degree.
Hold DoD 8140 DCWF 531 Advanced certification before the start date.
Be able to obtain a DoD TS/SCI clearance; candidates cannot start without a DoD TS/SCI clearance.
Experience with the ServiceNow Security Operations (SecOps) module for incident tracking and SLA management.
Proficiency with Elastic Stack for SIEM-based alert triage, event correlation, and incident timeline reconstruction.
Working knowledge of NIST SP 800-61 Rev. 3 and DoD/Army incident response policy frameworks.
Experience developing and exercising incident response playbooks for common cyberattack scenarios in a DoD environment.
Familiarity with digital forensics tools and techniques for evidence collection, chain of custody, and artifact analysis.
Experience operating in a 24/7 CSSP or SOC environment supporting classified Army or DoW networks.

Nice To Haves

Active DoD TS/SCI clearance.

Responsibilities

Manage the full cyber incident lifecycle, from detection and triage through containment, eradication, recovery, and post-incident review, following NIST SP 800-61 Rev. 3 and Army incident response procedures.
Coordinate active incident response with internal GCC teams, supported unit commanders, NETCOM, and ARCYBER; provide incident status updates and ensure timely, accurate communication.
Produce analysis reports documenting each incident’s timeline, scope, impact, root cause, and remediation actions.
Maintain accurate incident tracking records, case data, evidence artifacts, analyst notes, and closure documentation in accordance with GCC quality standards and audit requirements.
Conduct post-incident reviews and lessons-learned sessions to identify process gaps, detection failures, and response inefficiencies, and translate findings into actionable improvements for the GCC CSSP.
Mentor associate-level staff and perform quality assurance reviews of team output.
Develop, maintain, and exercise incident response playbooks for attack scenarios such as ransomware, phishing, credential theft, and insider threat, keeping procedures current with threats, Army policy, and mission requirements.
Work with the forensics SME to investigate incidents and analyze digital evidence.