Senior Incident Response Analyst
About The Position
Leidos is seeking a Senior Incident Response Analyst to support the DHS CISA Program. The Department of Homeland Security Security Operations Center Support Services program monitors, detects, analyzes, mitigates, and responds to cyber threats and adversarial activity across the DHS Enterprise. The DHS SOC has primary responsibility for security events and incidents detected at the Trusted Internet Connection and Policy Enforcement Point, and directs and coordinates detection and response activities with Component SOCs through a shared incident tracking system and other communication channels. The Incident Responder coordinates investigations and responses throughout the Incident Response lifecycle; analyzes events and artifacts to determine incident scope and root cause; improves monitoring and SOC detection capabilities; maintains incident response processes and security content; and documents investigations and prepares formal incident reports. Candidates need hands-on experience in incident detection and response, malware analysis, or computer forensics. DHS SOC employees must favorably pass a five-year background investigation.
Requirements
- Bachelor’s degree in Computer Science, Engineering, Information Technology, Cyber Security, or a related field and 8–12 years of related experience; additional experience and/or cyber certifications may be considered in lieu of a degree.
- In-depth knowledge of each phase of the Incident Response lifecycle.
- Expertise in Windows and Linux operating systems, operations, and artifacts.
- Expertise in enterprise network architectures, including routing and switching, common protocols such as DHCP, DNS, and HTTP, and devices such as firewalls, proxies, load balancers, and VPNs.
- Ability to recognize suspicious activity and common attacker TTPs, and to perform logical analysis and research to determine incident root cause and scope.
- Expertise with the Cyber Kill Chain and experience using the ATT&CK Framework.
- Scripting experience with Python, PowerShell, and/or Bash.
- Ability to independently prioritize and complete multiple tasks with little to no supervision.
- Flexible, adaptable self-starter with strong relationship-building skills.
- Strong problem-solving abilities and an analytic, qualitative approach to reasoning.
- Strong verbal and written communication skills, including the ability to communicate with subordinates, peers, and leadership.
- Hands-on technical experience in incident detection and response, malware analysis, or computer forensics.
- Must favorably pass a five-year (BI) Background Investigation.
- Must have at least one listed certification: SANS GIAC GCIH, GCIA, GCFA, GPEN, GCFE, or GREM; CISSP; OSCP; OSCE; or OSWP.
Nice To Haves
- Experience in cyber government and/or federal law enforcement FISMA systems.
Responsibilities
- Coordinate investigation and response efforts throughout the Incident Response lifecycle.
- Correlate and analyze events and data to determine the scope of cyber incidents.
- Acquire and analyze endpoint and network artifacts, volatile memory, malicious files or binaries, and scripts.
- Recognize attacker tactics, techniques, and procedures as potential indicators of compromise to improve monitoring, analysis, and incident response.
- Develop, document, and maintain Incident Response processes, procedures, workflows, and playbooks.
- Tune and maintain security tools, including EDR, IDS, and SIEM, to reduce false positives and improve SOC detection capabilities.
- Document investigation and incident response actions in case management systems and prepare formal incident reports.
- Create metrics and determine Key Performance Indicators to improve the maturity of SOC operations.
- Develop security content such as scripts, signatures, and alerts.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
