Cyber Incident Response Analyst

Program Role: CIR Tier II Analyst (ON-SITE in Martinsburg, WV)

Armavel, LLC is offering an opportunity to be a part of a growing, forward-thinking team in an engaging, fast-paced environment. As a Cyber Incident Response Analyst, you will play a critical role in safeguarding the Department of Veterans Affairs (VA) digital assets.

Duties

• Perform real-time monitoring and triage of security alerts in Cybersecurity toolsets including SIEM, and EDR
• Make accurate determination of what alerts are false positives or require further investigation and prioritization
• Lead and actively participate in the investigation, analysis, and resolution of cybersecurity incidents. Analyze attack patterns, determine the root cause, and recommend appropriate remediation measures to prevent future occurrences
• Ensure accurate and detailed documentation of incident response activities, including analysis, actions taken, and lessons learned. Collaborate with knowledge management teams to maintain up-to-date incident response playbooks
• Collaborate effectively with cross-functional teams, including forensics, threat intelligence, IT, and network administrators. Clearly communicate technical information and incident-related updates to management and stakeholders
• Identify and action opportunities for tuning alerts to make the incident response team more efficient
• Monitor the performance of security analytics and automation processes regularly, identifying areas for improvement and taking proactive measures to enhance their efficacy
• Leverage Security Orchestration, Automation, and Response (SOAR) platforms to streamline and automate incident response processes, including enrichment, containment, and remediation actions
• Support the mentoring and training of more junior IR staff
• Stay informed about the latest cybersecurity threats, trends, and best practices. Actively participate in cybersecurity exercises, drills, and simulations to improve incident response capabilities

Requirements

• Bachelor's degree in computer science, Cybersecurity, Information Technology, or a related field (or equivalent work experience)
• 3+ years of experience supporting incident response in an enterprise-level Security Operations Center (SOC)
• A deep understanding of cybersecurity principles, incident response methodologies, and a proactive mindset to ensure our SOC operates effectively in a high-pressure environment.
• Strong experience with security technologies, including SIEM, IDS/IPS, EDR, and network monitoring tools
• Experience with enterprise ticketing systems like ServiceNow
• Excellent analytical and problem-solving skills.
• Ability to work independently and in a team environment to identify errors, pinpoint root causes, and devise solutions with minimal oversight.
• Ability to learn and function in multiple capacities and learn quickly.
• Strong verbal and written communication skills

Must currently have or be willing to obtain one of the following certifications (or equivalent):

• GIAC Certified Incident Handler
• EC-Council’s Certified Incident Handler (E|CIH)
• GIAC Certified Incident Handler (GCIH)
• Incident Handling & Response Professional (IHRP)
• Certified Computer Security Incident Handler (CSIH)
• Certified Incident Handling Engineer (CIHE)
• EC-Council’s Certified Ethical Hacker