Mid Cybersecurity Incident Analyst

ECS Tech Inc•Arlington, VA

2h•$140,000 - $160,000•Hybrid

About The Position

Everforth ECS is seeking a Mid Cybersecurity Incident Analyst to support the CISA Technical Engineering and Support Services (TESS) program and Joint Cyber Defense Collaborative (JCDC) Operations. The position is based in Arlington, Virginia, and is hybrid. It is contingent upon contract award. The analyst provides deep technical analysis during active cyber incidents, including insights into vulnerabilities, adversarial tactics, and mitigation strategies across IT, OT/ICS, cloud, and AI environments. The role supports coordination with CISA Vulnerability Management and Threat Hunt teams, and provides guidance and analysis on active cyber threats for JCDC partners. The analyst will help define critical data sources for collection, inform processes, write detection rules, and analyze active and emerging threats and incidents affecting the Federal Civilian Executive Branch, critical infrastructure, and State, Local, Tribal, and Territorial entities. The analyst works with stakeholders including DHS CISA Threat Hunt and Vulnerability Management teams, agency security analysts and user groups, and the ECS team to align solution development with stakeholder needs. The role also involves researching and assisting with solutions for specific indicators of compromise and attack, and helping advance threat hunting and incident response tools, processes, and procedures.

Requirements

Active Top Secret clearance.
U.S. citizenship and the ability to obtain and maintain at least DHS Suitability EOD/Public Trust.
At least 6 years of experience in threat intelligence, cybersecurity, incident response, or a similar role.
Strong understanding of computer and network fundamentals.
Basic understanding of computer architecture, operating systems, vulnerabilities, encryption, or another area of expertise.
Experience defining data sources and writing detection rules to discover malicious behavior.
Ability to perform in-depth research with minimal support and produce written summaries that include insights and predictions based on an analytical process.
Excellent written and oral communication skills.
Understanding of current cyber threats and exploits, attack methodology, and detection techniques using a wide variety of security products, including commercial off-the-shelf and open-source products.

Responsibilities

Analyze active cyber incidents, events, and vulnerabilities and provide guidance and targeted mitigation recommendations.
Support development of written guidance and recommendations to help JCDC partners address active and ongoing cyber vulnerabilities.
Stay current with emerging cybersecurity technologies and trends and apply that knowledge to improve threat detection and mitigation.
Use hands-on analysis to assess vulnerabilities, adversarial tactics, and mitigation strategies across IT, OT/ICS, cloud, and AI environments.
Assist in mapping technical insights on cyber threats to MITRE ATT&CK and other cyber frameworks.
Help translate strategic products into clear, practical formats tailored to stakeholder needs and operational constraints, including those of large and small jurisdictions and critical infrastructure partners.
Assist in tailoring vulnerability mitigation recommendations and contextualized examples to address implementation challenges and encourage rapid adoption.
Assist in defining data sources and writing detection rules to discover malicious behavior.
Research specific indicators of compromise and attack and help develop tools, processes, and procedures that advance threat hunting and incident response capabilities.