Incident Response Analyst

Leidos•Alexandria, VA

4d•$87,100 - $157,450•Onsite

About The Position

Leidos is seeking an experienced Incident Response Analyst to support the Defense Manpower Data Center (DMDC) CyberPRIMES program. This role involves investigating and responding to cybersecurity events and incidents affecting Defense Human Resources Activity (DHRA) systems and networks. The analyst will manage the full incident-response lifecycle, from detection and analysis through containment, eradication, recovery, and post-incident activities. This position requires close collaboration with Security Operations Center analysts, Cybersecurity Service Providers, system owners, and technical teams during active cybersecurity incidents. The work environment supports both Non-classified Internet Protocol Router Network (NIPRNet) and Secret Internet Protocol Router Network (SIPRNet) environments, requiring analysts to quickly move from event identification to investigation and coordinated response while maintaining accurate records, preserving evidence, and keeping stakeholders informed.

Requirements

Bachelor’s degree and 5 or more years of relevant cybersecurity experience. Specific experience, education and training may be considered in lieu of degree.
Experience supporting cybersecurity incident response, Security Operations Center operations, cyber defense, or security-event investigation.
Experience performing analysis of cybersecurity events and determining appropriate response or escalation actions.
Experience supporting incident containment, eradication, recovery, and post-incident activities.
Experience monitoring and analyzing enterprise cybersecurity tools and security telemetry.
Experience documenting incident timelines, investigative findings, evidence, response actions, and status.
Experience coordinating cybersecurity incidents across technical teams and stakeholder organizations.
Working knowledge of network, endpoint, and enterprise cybersecurity monitoring concepts.
Ability to recognize potential intrusion activity and support rapid mitigation of cybersecurity threats.
Ability to communicate clearly during active cybersecurity incidents and maintain accurate documentation under time-sensitive conditions.
Ability to support after-hours incident response and the required one-hour recall when assigned.
U.S. Citizenship required.
Active Secret security clearance required.

Nice To Haves

Experience supporting cybersecurity incident response within Department of Defense or Federal environments.
Experience responding to incidents in both unclassified and classified network environments.
Experience with Security Information and Event Management platforms and enterprise security-monitoring capabilities.
Experience analyzing endpoint-security, firewall, Intrusion Detection System, Intrusion Prevention System, web-security, antispam, or malware-prevention data.
Experience supporting evidence collection and preservation during cybersecurity investigations.
Experience coordinating incident response with Security Operations Center personnel, Cybersecurity Service Providers, system owners, network teams, and other technical organizations.
Experience operating in a 24x7 cybersecurity operations environment or supporting after-hours incident response.
Familiarity with Department of Defense cybersecurity incident-response processes and requirements.
Familiarity with DHRA, DMDC, or comparable Department of Defense enterprise environments.

Responsibilities

Support preparation, detection, analysis, containment, eradication, recovery, and post-incident activities for cybersecurity events and incidents.
Investigate cybersecurity incidents affecting NIPRNet and SIPRNet environments.
Perform proactive security monitoring and analysis to identify potential intrusion attempts and other malicious activity.
Analyze security information from Security Information and Event Management (SIEM) platforms, endpoint-security capabilities, firewalls, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), web-security systems, antispam capabilities, malware-prevention systems, and related enforcement technologies.
Recognize potential intrusion attempts, malicious activity, or other cybersecurity conditions requiring immediate investigation or mitigation.
Assess cybersecurity events to determine scope, potential impact, affected systems, and required response actions.
Support containment and mitigation of active cybersecurity threats in accordance with approved Government procedures.
Coordinate eradication and recovery activities with system owners, administrators, network personnel, cybersecurity teams, and other technical stakeholders.
Collect and preserve technical evidence associated with cybersecurity events and incidents.
Maintain complete and accurate incident records, timelines, supporting evidence, investigative findings, response actions, and status information.
Develop and contribute to required cybersecurity event and incident reporting.
Coordinate incident-response activities with Security Operations Center analysts, Cybersecurity Service Providers (CSSPs), system owners, technical teams, and Government stakeholders.
Support escalation of significant cybersecurity events and incidents in accordance with established procedures.
Provide timely status updates during active investigations and incident-response activities.
Support post-incident analysis and lessons learned to identify opportunities to improve monitoring, detection, response procedures, and defensive capabilities.
Participate in after-hours incident response when assigned and meet the contract-required one-hour recall requirement.