Senior Incident Response Analyst

Leidos • Arlington, VA

3d

About The Position

Leidos is seeking a Senior Incident Response Analyst to support the DHS CISA Security Operations Center (SOC) Support Services program. The DHS SOC monitors, detects, analyzes, mitigates, and responds to cyber threats and adversarial activity across the DHS Enterprise, with primary responsibility for security events and incidents detected at the Trusted Internet Connection (TIC) and Policy Enforcement Point (PEP). It also directs and coordinates detection and response activities performed by Component SOCs through a shared incident tracking system and other coordination channels.

The analyst will coordinate investigations throughout the incident response lifecycle, examine endpoint and network evidence, improve SOC detection capabilities, document response actions, and help mature SOC operations through metrics, performance indicators, and security content development.

Requirements

• Bachelor’s degree in Computer Science, Engineering, Information Technology, Cyber Security, or a related field, and 8–12 years of related experience; additional experience and/or cyber certifications may be considered in lieu of a degree.
• In-depth knowledge of each phase of the incident response lifecycle.
• Expertise in Windows and Linux operating systems, operations, and artifacts.
• Expertise in enterprise network architectures, including routing and switching, common protocols such as DHCP, DNS, and HTTP, and devices such as firewalls, proxies, load balancers, and VPNs.
• Ability to recognize suspicious activity and events, identify common attacker TTPs, and use logical analysis and research to determine incident root cause and scope.
• Expertise with the Cyber Kill Chain and experience using the ATT&CK Framework.
• Scripting experience with Python, PowerShell, and/or Bash.
• Ability to independently prioritize and complete multiple tasks with little to no supervision.
• Flexible, adaptable self-starter with strong relationship-building skills.
• Strong problem-solving abilities and analytical and qualitative reasoning.
• Strong verbal and written communication skills, including the ability to communicate with subordinates, peers, and leadership.
• Hands-on technical experience in incident detection and response, malware analysis, or computer forensics.
• Must favorably pass a five-year DHS Background Investigation.
• Must have at least one of the following certifications: SANS GIAC GCIH, GCIA, GCFA, GPEN, GCFE, or GREM; CISSP; or OSCP, OSCE, or OSWP.

Nice To Haves

• Experience in cyber government, federal law enforcement, and/or FISMA systems.

Responsibilities

• Coordinate investigation and response efforts throughout the Incident Response lifecycle.
• Correlate and analyze events and data to determine the scope of cyber incidents.
• Acquire and analyze endpoint and network artifacts, volatile memory, malicious files or binaries, and scripts.
• Recognize attacker tactics, techniques, and procedures as potential indicators of compromise that can improve monitoring, analysis, and incident response.
• Develop, document, and maintain incident response processes, procedures, workflows, and playbooks.
• Tune and maintain security tools, including EDR, IDS, and SIEM, to reduce false positives and improve SOC detection capabilities.
• Document investigation and incident response actions in case management systems and prepare formal incident reports.
• Create metrics and determine key performance indicators to drive SOC operational maturity.
• Develop security content such as scripts, signatures, and alerts.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior