Incident Response Analyst, Senior

Booz Allen Hamilton•Huntsville, AL

About The Position

Incident Response Analyst, Senior Key Role: Apply an understanding of monitoring, analyzing, detecting, and responding to cyber events and incidents in information systems and networks. Contribute to an integrated, dynamic cyber defense and leverage cybersecurity solutions to deliver cybersecurity operational services, including intrusion detection and prevention, situational awareness of network intrusions, security events, and data spillage, and incident response actions. Contribute to the development of innovative principles and ideas, work on unusually complex problems, and provide solutions that are highly creative. Handle major, high-impact incidents, generate clear, concise recommendations, and coordinate activities and professional communications across a range of stakeholders. Work closely with security teams to develop, tune, automate, and enhance network and host-based security devices, support the Security Operations Center (SOC) with managing the response to client Cyber intrusions, perform extensive network and host triage, maintain strict chain-of-custody, analyze documentation and reports, and perform remediation, as required.

Requirements

5+ years of experience in cybersecurity or information technology disciplines
3+ years of experience with Advanced Persistent Threat (APT) hunting, penetration testing, digital forensics, malware reverse engineering, SOC operations, or incident response
Experience with Incident Response tools such as SentinelOne, Splunk, or Microsoft Defender
Ability to adapt communications styles and messaging for professionals at all levels of leadership
Secret clearance
Bachelor's degree
OSCP, CCNA-Security, CySA+, GCIH, GICSP, or PenTest+ Certification

Nice To Haves

Ability to detect and search for MITRE ATT&CK TTPs and common attacker methodologies using PCAP data with tools such as Wireshark
Ability to analyze Security Information and Event Management (SIEM) alerts to identify security issues for investigation and remediation
Ability to profile and track malicious actors that pose a threat in coordination with threat intelligence support teams
Ability to review and analyze security log files from various sources, including cloud, network, endpoint, or ICAM
Ability to be self-driven, work independently, and handle multiple tasks concurrently
TS/SCI clearance

Responsibilities

monitoring, analyzing, detecting, and responding to cyber events and incidents in information systems and networks
contribute to an integrated, dynamic cyber defense
leverage cybersecurity solutions to deliver cybersecurity operational services, including intrusion detection and prevention, situational awareness of network intrusions, security events, and data spillage, and incident response actions
contribute to the development of innovative principles and ideas
work on unusually complex problems
provide solutions that are highly creative
handle major, high-impact incidents
generate clear, concise recommendations
coordinate activities and professional communications across a range of stakeholders
work closely with security teams to develop, tune, automate, and enhance network and host-based security devices
support the Security Operations Center (SOC) with managing the response to client Cyber intrusions
perform extensive network and host triage
maintain strict chain-of-custody
analyze documentation and reports
perform remediation, as required