Incident Handler - Senior

Peraton•Fort Huachuca, AZ

2d•$80,000 - $128,000

About The Position

Peraton is seeking a Senior Cyber Incident Response Analyst to conduct highly technical investigations into cybersecurity incidents and manage the full incident lifecycle, from initial detection and triage through containment, eradication, recovery, and post-incident review. The role coordinates incident response activities with GCC teams, supported unit commanders, NETCOM, and ARCYBER, and works with a forensics subject matter expert to investigate incidents and analyze digital evidence. The analyst documents incident scope, impact, root cause, and remediation actions; maintains complete case records; and develops response playbooks, lessons learned, and process improvements to strengthen the GCC Cybersecurity Service Provider (CSSP) mission. The position also provides technical leadership through mentoring associate-level staff and quality assurance reviews of team output.

Requirements

Experience requirement depends on education: 2 years with a bachelor’s degree; 4 years with an associate degree; 0 years with a master’s degree; or 6 years with no degree.
Must hold DoD 8140 DCWF 531 Advanced certification before the start date.
Ability to obtain a DoD Secret clearance.
Experience with the ServiceNow Security Operations (SecOps) module for incident tracking and SLA management.
Proficiency with Elastic Stack for SIEM-based alert triage, event correlation, and incident timeline reconstruction.
Working knowledge of NIST SP 800-61 Rev. 3 and DoD/Army incident response policy frameworks.
Experience developing and exercising incident response playbooks for common cyberattack scenarios in a DoD environment.
Familiarity with digital forensics tools and techniques for evidence collection, chain of custody, and artifact analysis.
Experience operating in a 24/7 CSSP or SOC environment supporting classified Army or DoW networks.

Nice To Haves

An active DoD Secret clearance is preferred.

Responsibilities

Manage the full cyber incident lifecycle in accordance with NIST SP 800-61 Rev. 3 and Army incident response procedures.
Coordinate with internal GCC teams, supported unit commanders, NETCOM, and ARCYBER during active incidents; serve as the primary point of contact for status updates and ensure timely, accurate communication.
Produce analysis reports documenting each incident’s timeline, scope, impact, root cause, and remediation actions.
Maintain accurate incident tracking records, including case data, evidence artifacts, analyst notes, and closure documentation, in accordance with GCC quality standards and audit requirements.
Conduct post-incident reviews and lessons-learned sessions to identify process gaps, detection failures, and response inefficiencies, and translate findings into improvements for the GCC CSSP.
Mentor associate-level staff and perform quality assurance reviews of team output.
Develop, maintain, and exercise incident response playbooks for scenarios including ransomware, phishing, credential theft, and insider threats; keep procedures current with the threat landscape, Army policy requirements, and mission needs.