Cyber Incident Response Analyst

We are seeking an Incident Response Analyst to strengthen a federal agency's Cyber Incident Response Team. You will independently manage active investigations, using government-furnished tooling to identify root causes and produce documentation supporting security investigators. You will typically own several concurrent cases at a time, coordinating with system owners, forensics, and threat intelligence as needed to bring each one to a clean, well-documented close.

Responsibilities

Respond to information system security incidents using the government-furnished toolset to identify and determine root causes; Produce required documentation and possible evidence for authorized personnel with legal or investigative authorities; Support advanced analysis of data file system artifacts, memory, and network logs during active incidents; Assist in scoping and containing compromises across Windows, Linux, and cloud environments; Contribute to post-incident recommendations for improving the agency's security posture; Coordinate directly with system owners and ISSOs during containment and remediation activities; Support email trace, purge, and data spillage sanitization efforts per established procedures; Mentor junior CIRT analysts on evidence handling and case documentation standards

Requirements

US Citizenship; 3+ years of related experience; BS degree (or 4 years of additional experience); A minimum of one (1) year professional experience in network or UNIX/Linux system administration, software engineering, or software development, and/or a bachelor's degree in a related field; A minimum of three (3) years of professional experience responding to information system security incidents (Tier 1 specialization); One or more of the following certifications: CompTIA A+, Network+, Security+, GSEC, SSCP; Work authorization in the United States that does not now or in the future require visa sponsorship

Nice to have

Experience owning multiple concurrent incident investigations from triage through closure; Working knowledge of at least one EDR platform in an investigative capacity; Demonstrated ability to communicate technical findings clearly to non-technical stakeholders

Benefits

Wide variety of benefits; Hands-on experience, certifications, industry training and more