Incident Handler - Senior

Peraton•Fort Huachuca, AZ

About The Position

Peraton is seeking a Senior Cyber Incident Response Analyst to conduct highly technical investigations into cybersecurity incidents and manage the incident lifecycle from detection and triage through containment, eradication, recovery, and post-incident review. The role coordinates response activities with GCC teams, supported unit commanders, NETCOM, and ARCYBER; collaborates with a forensics subject-matter expert to investigate incidents and analyze digital evidence; and documents incident scope, impact, root cause, and remediation actions. The analyst maintains complete case records and develops response playbooks, lessons learned, and process improvements to strengthen the GCC Cybersecurity Service Provider (CSSP) mission. The position also provides technical leadership through mentorship of associate-level staff and quality assurance reviews. Candidates must hold the DoD 8140 DCWF 531 Advanced certification before starting and must have a DoD TS/SCI clearance before starting; Peraton may submit a candidate for clearance, while an active clearance is preferred. The role supports classified Army or DoW networks in a 24/7 CSSP or SOC environment. The target salary range is $80,000–$128,000. Eligible employees may receive benefits including medical, dental, vision, life insurance, health savings account, short- and long-term disability, EAP, parental leave, 401(k), paid time off, and company-paid holidays. Depending on the position, employees may also be eligible for overtime, shift differential, and a discretionary bonus.

Requirements

Meet one of the stated experience and education combinations: 5 years with a bachelor's degree; 7 years with an associate degree; 3 years with a master's degree; or 9 years with no degree.
Hold DoD 8140 DCWF 531 Advanced certification before the start date.
Have a DoD TS/SCI clearance before starting; the posting states Peraton can submit a candidate for clearance and that an active clearance is preferred.
Experience with the ServiceNow Security Operations (SecOps) module for incident tracking and SLA management.
Proficiency with Elastic Stack for SIEM-based alert triage, event correlation, and incident timeline reconstruction.
Working knowledge of NIST SP 800-61 Rev. 3 and DoD/Army incident response policy frameworks.
Experience developing and exercising incident response playbooks for common cyberattack scenarios in a DoD environment.
Familiarity with digital forensics tools and techniques for evidence collection, chain of custody, and artifact analysis.
Experience operating in a 24/7 CSSP or SOC environment supporting classified Army or DoW networks.

Nice To Haves

An active DoD TS/SCI clearance.

Responsibilities

Manage the cyber incident lifecycle from detection and triage through containment, eradication, recovery, and post-incident review in accordance with NIST SP 800-61 Rev. 3 and Army incident response procedures.
Coordinate active incident response with internal GCC teams, supported unit commanders, NETCOM, and ARCYBER; provide incident status updates and ensure timely, accurate communication.
Produce incident analysis reports documenting timelines, scope, impact, root cause, and remediation actions.
Maintain accurate incident tracking records, including case data, evidence artifacts, analyst notes, and closure documentation, in line with GCC quality standards and audit requirements.
Conduct post-incident reviews and lessons-learned sessions to identify process gaps, detection failures, and response inefficiencies, and recommend actionable improvements for the GCC CSSP.
Mentor associate-level staff and perform quality assurance reviews of team output.
Develop, maintain, and exercise incident response playbooks for scenarios such as ransomware, phishing, credential theft, and insider threat.
Investigate incidents and analyze digital evidence in coordination with the forensics subject-matter expert.