Senior Incident Response Analyst
About The Position
Leidos is seeking a Senior Incident Response Analyst to support the DHS CISA Security Operations Center (SOC) Support Services program. The DHS SOC monitors, detects, analyzes, mitigates, and responds to cyber threats and adversarial activity across the DHS Enterprise. The SOC monitors and responds to events and incidents detected at the Trusted Internet Connection (TIC) and Policy Enforcement Point (PEP), and directs and coordinates detection and response activities performed by Component SOCs through a shared DHS incident tracking system and other communication channels. The Incident Responder coordinates investigations and responses across the Incident Response lifecycle, analyzes event and forensic data to establish incident scope, and uses findings about attacker tactics, techniques, and procedures to improve monitoring and response. The role also develops and maintains response procedures and playbooks, tunes security tools, documents investigations, creates operational metrics, and develops security content.
Requirements
- Bachelor’s degree in Computer Science, Engineering, Information Technology, Cyber Security, or a related field, and 8–12 years of related experience; additional experience and/or cyber certifications may be considered in lieu of a degree.
- In-depth knowledge of each phase of the Incident Response lifecycle.
- Expertise in Windows and Linux operating systems, including their operations and artifacts.
- Expertise in enterprise network architectures, including routing and switching, common protocols such as DHCP, DNS, and HTTP, and devices such as firewalls, proxies, load balancers, and VPNs.
- Ability to recognize suspicious activity and events, identify common attacker TTPs, and conduct logical analysis and research to determine incident root cause and scope.
- Expertise with the Cyber Kill Chain and experience using the ATT&CK Framework.
- Scripting experience with Python, PowerShell, and/or Bash.
- Ability to independently prioritize and complete multiple tasks with little to no supervision.
- Flexible, adaptable self-starter with strong relationship-building skills.
- Strong problem-solving abilities and an analytic, qualitative approach to reasoning.
- Strong verbal and written communication skills, including the ability to communicate with subordinates, peers, and leadership.
- Hands-on technical experience in incident detection and response, malware analysis, or computer forensics.
- Ability to favorably pass a 5-year Background Investigation (BI), as required for all DHS SOC employees.
- At least one of the following certifications: SANS GIAC GCIH, GCIA, GCFA, GPEN, GCFE, or GREM; CISSP; OSCP; OSCE; or OSWP.
Nice To Haves
- Experience in cyber government and/or federal law enforcement FISMA systems.
Responsibilities
- Coordinate investigation and response efforts throughout the Incident Response lifecycle.
- Correlate and analyze events and data to determine the scope of cyber incidents.
- Acquire and analyze endpoint and network artifacts, volatile memory, malicious files and binaries, and scripts.
- Recognize attacker tactics, techniques, and procedures as potential indicators of compromise to improve monitoring, analysis, and incident response.
- Develop, document, and maintain Incident Response processes, procedures, workflows, and playbooks.
- Tune and maintain security tools, including EDR, IDS, and SIEM, to reduce false positives and improve SOC detection capabilities.
- Document investigation and Incident Response actions in case management systems and prepare formal incident reports.
- Create metrics and determine key performance indicators to drive the maturity of SOC operations.
- Develop security content such as scripts, signatures, and alerts.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
