Cyber Incident Response Analyst with OT/ICS/SCADA / Travel & Active TS

We need to output HTML fragment with sections: About the role (but we already have "About The Role" heading in the posting; we should use

for section headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must not repeat job title as heading. We need to preserve all substantive info, remove boilerplate (cookie/navigation/legal/EEO/equal-opportunity/scam-warning, duplicated lines, application instructions). Also we need to include sections only when posting has real specific content. We have content: About Peraton (company description) maybe not needed? The instruction: "Do NOT repeat the job title as a heading (the page already shows it) and do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short

or drop it." The posting includes "About Peraton" and "About The Role". We should treat "About The Role" as a section heading? The allowed headings list includes "About the role". So we can use

About the role

and put the description there. We also have responsibilities: "In This Role, You Will:" bullet list. That's responsibilities. So we can have

Responsibilities

with

• items. Qualifications: there are Required Qualifications and Desired Qualifications. We can combine into a Qualifications section with required and desired maybe separate subheadings? But only allowed headings are those listed; we could still have

  Qualifications

  and include both required and desired as lists. Skills: maybe we can extract desired qualifications like certifications, scripting etc. Could put under Skills. Benefits: there is Benefits Statement. So

  Benefits

  with list. Pay: there is Target Salary Range. So

  Pay

  with that range. Schedule: there is location, travel, on-site requirements. Could be Schedule section: location, travel %, on-site requirement. So

  Schedule

  with details. We must not include sections with filler like "commensurate with experience". We have actual content. We must not include application instructions, EEO, etc. We need to preserve all substantive information: company description maybe not needed? It's about Peraton; could be considered part of About the role? Might be considered boilerplate? It's not about the role specifically but about the company. The instruction: "Prefer a few substantive sections over many thin ones." Could include a short paragraph about company under About the role or maybe a separate section? Not in allowed headings. Probably we can include it under About the role as introductory paragraph. We need to output only HTML fragment, no /, no markdown fences. Let's extract details: About Peraton: "Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world's leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees solve the most daunting challenges that our customers face. Visit peraton.com to learn how we're keeping people around the world safe and secure." About The Role: "Peraton is currently seeking to hire an experienced Incident Response Analyst (ICS/OT/SCADA) for its' Federal Strategic Cyber group. Location: On-site in Arlington, VA Travel: Approximately 40% Peraton is seeking an experienced Incident Response Analyst with strong OT/ICS/SCADA expertise to support its Federal Strategic Cyber program. This role involves responding to cyber incidents across critical infrastructure sectors and working closely with technical teams, forensic analysts, and mission partners to safeguard national-level systems." Then responsibilities list (starting with "In This Role, You Will:"): each bullet: - Respond to cybersecurity incidents across ICS, OT, and IT environments and provide recommendations to prevent recurrence within critical infrastructure sectors. - Apply functional knowledge to resolve incidents, conduct proactive threat hunts, and contribute to solutions for problems of moderate scope and complexity. - Support highly technical operations and forensic analysis while advising client decision-makers. - Provide sector-specific expertise for one or more critical infrastructure areas, including Water, Power, Critical Manufacturing, and Transportation. - Follow established procedures for incident response and escalation. - Help define and refine response procedures for industrial control system environments. - Apply traditional incident response and threat-hunting tradecraft to ICS/critical-infrastructure environments while accounting for operational constraints. - Collaborate with host, network, and cloud forensic analysts to meet mission requirements for incident response and threat-hunting engagements. - Maintain accurate documentation of incident response activities and findings. - Prepare and deliver incident reports to management and stakeholders. - Work effectively in a team environment and contribute to mission success. - Stay current on cybersecurity trends to enhance hunt and response operations. - Demonstrate strong attention to detail, critical thinking, and customer-service orientation. - Self-teach and test new tools, methodologies, and techniques as needed. - Meet on-site requirements of at least one day per week (up to three days depending on mission needs). - Travel up to 40%. Qualifications Required: - Bachelor's degree and 5 years of relevant experience; Master's degree and 3 years. An additional 4 years of relevant experience will be considered in lieu of a degree. - Must have 1-2 years of relevant Threat Hunting or DFIR experience directly supporting Critical Infrastructure (CI) / ICS environments. - Experience conducting security site assessments, including analysis of network security architecture, baseline ports/protocols/services, and asset characterization. - Experience using SIEM tools for pattern identification, anomaly detection, and trend analysis. - Experience analyzing ICS network protocols such as ModBus, ENIP/CIP, BACnet, DNP3, etc. - Experience with common open-source and commercial tools used in event analysis, incident response, forensics, malware analysis, or security operations. - Experience with host-based and network-based collection and detection tools (OSS/COTS). - U.S. citizenship required. - Active Top Secret security clearance. - Ability to obtain a TS/SCI for continued employment. - Ability to obtain and maintain a favorably adjudicated DHS background investigation. Desired Qualifications: - Certifications such as GISCP, GCFA, GNFA, GRID, or OT sensor certifications. - 2+ years of Threat Hunting or DFIR experience. - Experience on DoD Cyber Protection Teams. - Experience performing digital forensics on laptops/desktops, PLCs, HMIs, Historians, and SCADA systems. - Experience with SIEM platforms (e.g., Splunk) including threat hunting, analytic development, dashboards, and reporting. - Familiarity with critical-infrastructure frameworks (NIST, IEC 62443). - Ability to automate repeatable tasks. - Scripting experience in Python, Bash, PowerShell, and/or JavaScript. Details: - Target Salary Range: $104,000 - $166,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual's experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay. - Benefits Statement: Peraton offers eligible employees a variety of benefits including medical, dental, vision, life, health savings account, short/long term disability, EAP, parental leave, 401(k), paid time off (PTO) for vacation, and company paid holidays. A full listing of available benefits can be viewed at https://www.careers.peraton.com/benefits. - Application Statements etc (to drop). - EEO etc (drop). We need to include Pay section with salary range. Benefits section with list. Schedule section: location, travel, on-site requirements. Could combine location and travel and on-site. We must not repeat job title as heading. So we will not have a heading for Incident Response Analyst. We need to output only HTML fragment. Let's craft:

  About the role

  Peraton is a next-generation national security company ... (company description) ... Peraton is currently seeking to hire an experienced Incident Response Analyst (ICS/OT/SCADA) for its Federal Strategic Cyber group. Location: On-site in Arlington, VA. Travel: Approximately 40%. This role involves responding to cyber incidents across critical infrastructure sectors and working closely with technical teams, forensic analysts, and mission partners to safeguard national-level systems.

  Responsibilities

  • Respond to cybersecurity incidents across ICS, OT, and IT environments and provide recommendations to prevent recurrence within critical infrastructure sectors.
  • Apply functional knowledge to resolve incidents, conduct proactive threat hunts, and contribute to solutions for problems of moderate scope and complexity.
  • Support highly technical operations and forensic analysis while advising client decision-makers.
  • Provide sector-specific expertise for one or more critical infrastructure areas, including Water, Power, Critical Manufacturing, and Transportation.
  • Follow established procedures for incident response and escalation.
  • Help define and refine response procedures for industrial control system environments.
  • Apply traditional incident response and threat-hunting tradecraft to ICS/critical-infrastructure environments while accounting for operational constraints.
  • Collaborate with host, network, and cloud forensic analysts to meet mission requirements for incident response and threat-hunting engagements.
  • Maintain accurate documentation of incident response activities and findings.
  • Prepare and deliver incident reports to management and stakeholders.
  • Work effectively in a team environment and contribute to mission success.
  • Stay current on cybersecurity trends to enhance hunt and response operations.
  • Demonstrate strong attention to detail, critical thinking, and customer-service orientation.
  • Self-teach and test new tools, methodologies, and techniques as needed.
  • Meet on-site requirements of at least one day per week (up to three days depending on mission needs).
  • Travel up to 40%.

  Qualifications

  Required:

  • Bachelor's degree and 5 years of relevant experience; Master's degree and 3 years. An additional 4 years of relevant experience will be considered in lieu of a degree.
  • Must have 1-2 years of relevant Threat Hunting or DFIR experience directly supporting Critical Infrastructure (CI) / ICS environments.
  • Experience conducting security site assessments, including analysis of network security architecture, baseline ports/protocols/services, and asset characterization.
  • Experience using SIEM tools for pattern identification, anomaly detection, and trend analysis.
  • Experience analyzing ICS network protocols such as ModBus, ENIP/CIP, BACnet, DNP3, etc.
  • Experience with common open-source and commercial tools used in event analysis, incident response, forensics, malware analysis, or security operations.
  • Experience with host-based and network-based collection and detection tools (OSS/COTS).
  • U.S. citizenship required.
  • Active Top Secret security clearance.
  • Ability to obtain a TS/SCI for continued employment.
  • Ability to obtain and maintain a favorably adjudicated DHS background investigation.

  Desired:

  • Certifications such as GISCP, GCFA, GNFA, GRID, or OT sensor certifications.
  • 2