Senior Incident Response Analyst

Leidos • Arlington, VA

20h

About The Position

Leidos is seeking a Senior Incident Response Analyst to support the DHS CISA Security Operations Center (SOC) Support Services program. The DHS SOC monitors, detects, analyzes, mitigates, and responds to cyber threats and adversarial activity across the DHS Enterprise. It has primary responsibility for security events and incidents detected at the Trusted Internet Connection (TIC) and Policy Enforcement Point (PEP), and coordinates detection and response activities with Component SOCs through a shared incident tracking system and other communications.

The analyst will coordinate investigations and responses throughout the incident response lifecycle, analyze events and artifacts to establish incident scope and root cause, improve SOC detection capabilities, and maintain incident response documentation and processes. The position requires hands-on experience in incident detection and response, malware analysis, or computer forensics. DHS SOC employees must favorably pass a five-year background investigation.

Requirements

• Bachelor’s degree in Computer Science, Engineering, Information Technology, Cyber Security, or a related field, and 12–15 years of related experience; additional experience and/or cyber certifications may be considered in lieu of a degree.
• In-depth knowledge of every phase of the incident response lifecycle.
• Expertise in Windows and Linux operating systems, their operations, and artifacts.
• Expertise in enterprise network architectures, including routing and switching, common protocols such as DHCP, DNS, and HTTP, and devices such as firewalls, proxies, load balancers, and VPNs.
• Ability to recognize suspicious activity and events and common attacker TTPs, and to perform logical analysis and research to determine incident root cause and scope.
• Expertise with the Cyber Kill Chain and experience using the ATT&CK Framework.
• Scripting experience with Python, PowerShell, and/or Bash.
• Ability to independently prioritize and complete multiple tasks with little to no supervision.
• Flexible, adaptable self-starter with strong relationship-building skills.
• Strong problem-solving abilities and an analytical, qualitative approach to reasoning.
• Strong verbal and written communication skills, including the ability to communicate with subordinates, peers, and leadership.
• Hands-on technical experience in incident detection and response, malware analysis, or computer forensics.
• At least one of the following certifications: SANS GIAC GCIH, GCIA, GCFA, GPEN, GCFE, or GREM; CISSP; OSCP, OSCE, or OSWP.
• Must favorably pass a five-year DHS background investigation.

Nice To Haves

• Experience in cyber government and/or federal law enforcement.
• Experience with FISMA systems.

Responsibilities

• Coordinate investigation and response efforts throughout the incident response lifecycle.
• Correlate and analyze events and data to determine the scope of cyber incidents.
• Acquire and analyze endpoint and network artifacts, volatile memory, malicious files and binaries, and scripts.
• Recognize attacker tactics, techniques, and procedures as potential indicators of compromise that can improve monitoring, analysis, and incident response.
• Develop, document, and maintain incident response processes, procedures, workflows, and playbooks.
• Tune and maintain security tools, including EDR, IDS, and SIEM, to reduce false positives and improve SOC detection capabilities.
• Document investigation and incident response actions in case management systems and prepare formal incident reports.
• Create metrics and determine key performance indicators to drive SOC operational maturity.
• Develop security content such as scripts, signatures, and alerts.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior