Washington, DC · On-site
$100K - $125K/yr
The ideal candidate has hands-on experience with enterprise IR tooling- CrowdStrike , FireEye (Trellix) , Splunk , NetWitness , and Magnet AXIOM -and is comfortable working in a high-tempo ...
Quick apply
Washington, DC · On-site
$100K - $125K/yr
The ideal candidate has hands-on experience with enterprise IR tooling- CrowdStrike , FireEye (Trellix) , Splunk , NetWitness , and Magnet AXIOM -and is comfortable working in a high-tempo ...
Washington, DC · On-site
$100K - $125K/yr
The ideal candidate has hands-on experience with enterprise IR tooling- CrowdStrike , FireEye (Trellix) , Splunk , NetWitness , and Magnet AXIOM -and is comfortable working in a high-tempo ...
Washington, DC · On-site
$100K - $125K/yr
The ideal candidate has hands-on experience with enterprise IR tooling- CrowdStrike , FireEye (Trellix) , Splunk , NetWitness , and Magnet AXIOM -and is comfortable working in a high-tempo ...
Austin, TX · On-site
... NetWitness, Gravwell, Google SecOps, and Corelight to validate findings and reconstruct attacker activity. 5 Required Ability to correlate host, network, and intelligence data from CrowdStrike ...
Austin, TX · On-site
... NetWitness, Gravwell, Google SecOps, and Corelight to validate findings and reconstruct attacker activity. 5 Required Ability to correlate host, network, and intelligence data from CrowdStrike ...
Austin, TX · On-site
... NetWitness, Gravwell, Google SecOps, and Corelight to validate findings and reconstruct attacker activity. 5 Required Ability to correlate host, network, and intelligence data from CrowdStrike ...
Austin, TX · On-site
... NetWitness, Gravwell, Google SecOps, and Corelight to validate findings and reconstruct attacker activity. 5 Required Ability to correlate host, network, and intelligence data from CrowdStrike ...
Qualifications 3+ years experience as a Cyber Security Analyst The tools we use are RSA Netwitness, enVision, QRadar and ArcSight, we'd prefer to have someone with extensive knowledge with those ...
Qualifications 3+ years experience as a Cyber Security Analyst The tools we use are RSA Netwitness, enVision, QRadar and ArcSight, we'd prefer to have someone with extensive knowledge with those ...
New York, NY · On-site
Qualifications 3+ years experience as a Cyber Security Analyst The tools we use are RSA Netwitness, enVision, QRadar and ArcSight, we'd prefer to have someone with extensive knowledge with those ...
New York, NY · On-site
Qualifications 3+ years experience as a Cyber Security Analyst The tools we use are RSA Netwitness, enVision, QRadar and ArcSight, we'd prefer to have someone with extensive knowledge with those ...
... NetWitness, Mandiant Security Verification, and SightGain. • The Application Support Specialist and the Systems Engineer will probably be required to back each other up and backup the incumbent ...
... NetWitness, Mandiant Security Verification, and SightGain. • The Application Support Specialist and the Systems Engineer will probably be required to back each other up and backup the incumbent ...
Austin, TX · On-site
Familiarity with NetWitness and/or Microsoft Sentinel. * Experience with tools such as Veracode, Tenable, or Horizon3 AI. * Basic knowledge of firewalls. Work Environment This position is part of a ...
Quick apply
Austin, TX · On-site
Familiarity with NetWitness and/or Microsoft Sentinel. * Experience with tools such as Veracode, Tenable, or Horizon3 AI. * Basic knowledge of firewalls. Work Environment This position is part of a ...
ExtraHop, Stealthwatch, Vectra AI, Darktrace, RSA NetWitness, CoreLight, Netscout nGenius or ISNG, BackTrack, Kali, HPING, ZAP, tcpreplay, CVE, VirusTotal, Wireshark, AlienVault, Cyber Kill Chain ...
Quick apply
ExtraHop, Stealthwatch, Vectra AI, Darktrace, RSA NetWitness, CoreLight, Netscout nGenius or ISNG, BackTrack, Kali, HPING, ZAP, tcpreplay, CVE, VirusTotal, Wireshark, AlienVault, Cyber Kill Chain ...
Experience with McAfee ePO, RSA Netwitness, Cisco ASA Firewall and SSM, Microsoft TMG 2010, Citrix NetScaler WAF * Log Analysis, Incident Response/Reporting, Auditing * Proven background in network ...
Experience with McAfee ePO, RSA Netwitness, Cisco ASA Firewall and SSM, Microsoft TMG 2010, Citrix NetScaler WAF * Log Analysis, Incident Response/Reporting, Auditing * Proven background in network ...
Security Information and Event Management tools - LogRhythm, ArcSight, NetWitness, Splunk Enterprise Security, or AlienVault experience highly desired
Security Information and Event Management tools - LogRhythm, ArcSight, NetWitness, Splunk Enterprise Security, or AlienVault experience highly desired
Be Seen First
Atlanta, GA · On-site
$135K - $150K/yr
... NetWitness, Mandiant Security Verification, and SightGain. • The Application Support Specialist and the Systems Engineer will probably be required to back each other up and backup the incumbent ...
Quick apply
Be Seen First
Atlanta, GA · On-site
$135K - $150K/yr
... NetWitness, Mandiant Security Verification, and SightGain. • The Application Support Specialist and the Systems Engineer will probably be required to back each other up and backup the incumbent ...
Be Seen First
Washington, DC · On-site
$135K - $150K/yr
... NetWitness, Mandiant Security Verification, and SightGain. • The Application Support Specialist and the Systems Engineer will probably be required to back each other up and backup the incumbent ...
Quick apply
Be Seen First
Washington, DC · On-site
$135K - $150K/yr
... NetWitness, Mandiant Security Verification, and SightGain. • The Application Support Specialist and the Systems Engineer will probably be required to back each other up and backup the incumbent ...
Security Information and Event Management tools - LogRhythm, ArcSight, NetWitness, Splunk Enterprise Security, or AlienVault experience highly desired
Security Information and Event Management tools - LogRhythm, ArcSight, NetWitness, Splunk Enterprise Security, or AlienVault experience highly desired
San Antonio, TX · On-site
$94K - $129K/yr
Strong packet capture and traffic analysis skills using tools like Corelight, NetWitness, and CRIBL to spot anomalies and lateral movement * Experience tuning EDR platforms such as CrowdStrike and ...
Quick apply
San Antonio, TX · On-site
$94K - $129K/yr
Strong packet capture and traffic analysis skills using tools like Corelight, NetWitness, and CRIBL to spot anomalies and lateral movement * Experience tuning EDR platforms such as CrowdStrike and ...
Scottsdale, AZ · On-site
$93K - $122K/yr
Experience analyzing both log and packet data in a SIEM (RSA NetWitness, Azure Sentinel, Splunk, etc.) * Strong understanding of incident response methodologies and reporting * Experience using ...
Scottsdale, AZ · On-site
$93K - $122K/yr
Experience analyzing both log and packet data in a SIEM (RSA NetWitness, Azure Sentinel, Splunk, etc.) * Strong understanding of incident response methodologies and reporting * Experience using ...
Arlington, VA · On-site +1
... NetWitness, and others. * Work with project managers, product owners, other application teams, cybersecurity personnel, and executives to inform business decisions, work collaboratively, and ...
Arlington, VA · On-site +1
... NetWitness, and others. * Work with project managers, product owners, other application teams, cybersecurity personnel, and executives to inform business decisions, work collaboratively, and ...
Scottsdale, AZ · On-site
$93K - $122K/yr
Experience analyzing both log and packet data in a SIEM (RSA NetWitness, Azure Sentinel, Splunk, etc.) * Strong understanding of incident response methodologies and reporting * Experience using ...
Quick apply
Scottsdale, AZ · On-site
$93K - $122K/yr
Experience analyzing both log and packet data in a SIEM (RSA NetWitness, Azure Sentinel, Splunk, etc.) * Strong understanding of incident response methodologies and reporting * Experience using ...
NetWitness Suite experience preferred. * Strong experience with Endpoint Detection and Response (EDR) platforms; CrowdStrike experience preferred. * Experience developing scripts and automation using ...
NetWitness Suite experience preferred. * Strong experience with Endpoint Detection and Response (EDR) platforms; CrowdStrike experience preferred. * Experience developing scripts and automation using ...
Arlington, VA · On-site
... NetWitness, and others. * Work with project managers, product owners, other application teams, cybersecurity personnel, and executives to inform business decisions, work collaboratively, and ...
Arlington, VA · On-site
... NetWitness, and others. * Work with project managers, product owners, other application teams, cybersecurity personnel, and executives to inform business decisions, work collaboratively, and ...
To thrive as a NetWitness Analyst, you need a solid background in cybersecurity, network analysis, and incident response, often supported by a degree in information technology or related certifications such as CISSP, CEH, or specifically RSA NetWitness certifications. Familiarity with the RSA NetWitness Platform, intrusion detection/prevention systems (IDS/IPS), security information and event management (SIEM) tools, and scripting languages is essential. Strong analytical thinking, effective communication, and attention to detail are important soft skills for success in this position. These capabilities ensure thorough threat detection, accurate forensic investigations, and strong collaboration with security teams to protect an organization's digital assets.
A NetWitness Analyst is primarily responsible for monitoring network activity, analyzing security incidents, and investigating potential threats using the RSA NetWitness Platform. On a daily basis, you will review logs and alerts, conduct deep packet inspections, and work with other security team members to respond to incidents and improve detection rules. You'll often collaborate with IT, compliance, and threat intelligence teams to address vulnerabilities and help implement proactive security measures. Staying updated on the latest cyber threats and refining response procedures are also key aspects of the role, making it a dynamic and critical position within any organization's security operations center.
A NetWitness job typically involves monitoring, analyzing, and responding to cybersecurity threats using the NetWitness platform. Professionals in this role work with security information and event management (SIEM) tools, threat intelligence, and network traffic analysis to detect and mitigate cyber risks. They may also investigate security incidents, configure NetWitness solutions, and collaborate with IT and security teams to enhance an organization's cybersecurity posture. This role is common in Security Operations Centers (SOCs) and requires expertise in cybersecurity principles.
$100K - $125K/yr
Full-time
Posted 11 days ago
Incident Response Analyst (Task 4 – Federal Cybersecurity Contract)
Location: Remote with occasional on-site (Washington, D.C. Metro Area)
Employment Type: Full-Time
Clearance: Public Trust (or eligibility to obtain)
We are seeking an experienced Incident Response Analyst to support Task 4 – Incident Response Management on a federal cybersecurity services contract. This role provides front-line security event triage, investigation, reporting, and coordination across multiple federal cybersecurity teams.
The ideal candidate has hands-on experience with enterprise IR tooling-CrowdStrike, FireEye (Trellix), Splunk, NetWitness, and Magnet AXIOM-and is comfortable working in a high-tempo operational environment aligned with federal cybersecurity frameworks (NIST, FISMA, OMB).
Perform initial triage of security events from SIEM, EDR, NDR, and log sources, including CrowdStrike, FireEye/Trellix, Splunk, NetWitness, and related platforms.
Conduct incident investigations, including host and network forensics, log analysis, and evidence review using tools such as NetWitness and AXIOM.
Coordinate closely with HHS CSIRC, OpDiv incident response teams, system owners, and security engineering staff to validate findings and recommend containment actions.
Provide daily updates, SITREPs, and written documentation of incident status, investigative steps, and remediation recommendations.
Develop incident dashboards and knowledge base documentation within Splunk and other IR platforms.
Support containment, eradication, and recovery efforts aligned to federal IR procedures.
Participate in tabletop exercises, readiness assessments, and operational continuity testing.
Monitor and manage the Incident Response Team (IRT) mailbox; escalate urgent items within required SLAs.
Assist with audit support, evidence gathering, and post-incident reviews.
Contribute to continuous improvement of incident response processes and playbooks.
2–5+ years of experience in cybersecurity operations, SOC analysis, or incident response.
Direct hands-on experience with IR tools, including:
CrowdStrike Falcon (EDR)
FireEye/Trellix (HX, Helix, or equivalent)
Splunk (SIEM, dashboards, search queries)
NetWitness (network forensics, packet analysis)
Magnet AXIOM (host forensics)
Strong understanding of adversary techniques, malware behavior, incident timelines, and forensic artifacts.
Familiarity with NIST 800-61, NIST 800-53, FISMA, OMB guidance.
Ability to clearly document investigations and communicate findings to technical and non-technical audiences.
Eligibility to obtain and maintain a Public Trust clearance.
Experience supporting federal agencies (HHS, DHS, DoD, DOJ, etc.).
Certifications such as Security+, CySA+, CEH, GCIH, GCIA, CHFI, or related.
Experience performing threat hunting across EDR, SIEM, and NDR tools.
Familiarity with packet analysis tools (Wireshark) and scripting languages (Python, PowerShell).
Experience with ServiceNow or similar ticketing platforms
Core hours: 7:00 AM – 5:00 PM EST, Monday through Friday, with the flexibility to support after-hours incidents as needed.
Participation in on-call rotations may be required.
Remote work permitted with reliable connectivity and camera-enabled participation.
