Incident Response Analyst Resume Jobs (NOW HIRING)

• Support preparation, detection, analysis, containment, eradication, recovery, and post-incident activities for cybersecurity events and incidents
• Investigate cybersecurity incidents affecting NIPRNet and SIPRNet environments
• Perform proactive security monitoring and analysis to identify potential intrusion attempts and malicious activity
• Analyze security information from SIEM platforms, endpoint-security capabilities, firewalls, IDS, IPS, web-security systems, antispam capabilities, malware-prevention systems, and related enforcement technologies
• Assess cybersecurity events to determine scope, potential impact, affected systems, and required response actions
• Support containment and mitigation of active cybersecurity threats in accordance with approved Government procedures
• Coordinate eradication and recovery activities with system owners, administrators, network personnel, cybersecurity teams, and technical stakeholders
• Collect and preserve technical evidence associated with cybersecurity events and incidents
• Maintain accurate incident records, timelines, supporting evidence, investigative findings, response actions, and status information
• Develop and contribute to required cybersecurity event and incident reporting
• Coordinate incident-response activities with SOC analysts, CSSPs, system owners, technical teams, and Government stakeholders
• Support escalation of significant cybersecurity events and incidents in accordance with established procedures
• Provide timely status updates during active investigations and incident-response activities
• Support post-incident analysis and lessons learned to improve monitoring, detection, response procedures, and defensive capabilities
• Participate in after-hours incident response when assigned and meet the contract-required one-hour recall requirement

• Bachelor’s degree and 5 or more years of relevant cybersecurity experience; specific experience, education and training may be considered in lieu of degree
• Experience supporting cybersecurity incident response, Security Operations Center operations, cyber defense, or security-event investigation
• Experience analyzing cybersecurity events and determining appropriate response or escalation actions
• Experience supporting incident containment, eradication, recovery, and post-incident activities
• Experience monitoring and analyzing enterprise cybersecurity tools and security telemetry
• Experience documenting incident timelines, investigative findings, evidence, response actions, and status
• Experience coordinating cybersecurity incidents across technical teams and stakeholder organizations
• Working knowledge of network, endpoint, and enterprise cybersecurity monitoring concepts
• Ability to recognize potential intrusion activity and support rapid mitigation of cybersecurity threats
• Ability to communicate clearly during active cybersecurity incidents and maintain accurate documentation under time-sensitive conditions
• Ability to support after-hours incident response and the required one-hour recall when assigned
• U.S. Citizenship required
• Active Secret security clearance required at time of consideration
• Preferred: experience supporting cybersecurity incident response within Department of Defense or Federal environments
• Preferred: experience responding to incidents in both unclassified and classified network environments
• Preferred: experience with SIEM platforms and enterprise security-monitoring capabilities
• Preferred: experience analyzing endpoint-security, firewall, IDS, IPS, web-security, antispam, or malware-prevention data
• Preferred: experience supporting evidence collection and preservation during cybersecurity investigations
• Preferred: experience coordinating incident response with SOC personnel, CSSPs, system owners, network teams, and other technical organizations
• Preferred: experience operating in a 24x7 cybersecurity operations environment or supporting after-hours incident response
• Preferred: familiarity with Department of Defense cybersecurity incident-response processes and requirements
• Preferred: familiarity with DHRA, DMDC, or comparable Department of Defense enterprise environments

Demonstrates expertise in cybersecurity incident response, including containment, eradication, and recovery activities. Proficient in analyzing security information from various cybersecurity tools and coordinating incident response across technical teams and stakeholders.

• Cybersecurity Incident Response
• Security Operations Center Operations
• SIEM Platform Analysis
• Incident Documentation and Reporting
• Network and Endpoint Security Monitoring

• Cybersecurity Analysis
• Incident Containment
• Malware Prevention
• Intrusion Detection Systems
• Firewall Management
• Endpoint Security
• Security Telemetry Monitoring
• Evidence Collection
• Post-Incident Analysis
• Cyber Defense

• Clear Communication
• Time Management
• Collaboration

• Active Secret Security Clearance

• NIPRNet
• SIPRNet
• Department of Defense
• Federal Environments
• Cybersecurity Operations
• Incident Response Procedures

• SIEM Platforms
• Endpoint-Security Tools
• Firewalls
• Intrusion Detection Systems
• Intrusion Prevention Systems
• Web-Security Systems
• Antispam Technologies
• Malware-Prevention Systems