Cybersecurity Incident and Application Analyst

This position is contingent upon a future opening with Gunnison.

About the role

Support cybersecurity incident detection, analysis, response, containment, recovery, and post-incident activities across NIH CIT enterprise network, web application, endpoint, server, and cloud environments.

• Monitor, investigate, validate, and triage security events, alerts, suspicious activity, and potential indicators of compromise; assign appropriate severity and criticality based on operational impact, threat context, and established escalation procedures.
• Apply the enterprise incident-response lifecycle: preparation; detection and analysis; containment, eradication, and recovery; and post-incident analysis.
• Analyze network traffic, system logs, endpoint telemetry, application activity, authentication events, and security-tool alerts to identify malicious, anomalous, or unauthorized activity.
• Evaluate network, web application, cloud, and endpoint environments for insecure configurations, vulnerable ports, unnecessary services, weak protocols, default credentials, insecure communication methods, and other security weaknesses.
• Perform cybersecurity incident analysis using tools and platforms such as FireEye or comparable endpoint/threat-detection technologies, Palo Alto IDS/IPS and firewall technologies, Splunk SIEM, Tenable vulnerability-management tools, and related security operations tools.
• Support investigation of web application and cloud security events, including suspicious access, misconfigurations, exposed services, anomalous traffic, unauthorized changes, and potential data-security risks.
• Maintain a working knowledge of common ports, protocols, network services, attack vectors, and security-control configurations relevant to incident investigation and response.
• Conduct or support incident containment and recovery activities in coordination with system owners, network engineers, cybersecurity engineers, application teams, and Government stakeholders.
• Create, update, and follow incident response playbooks, standard operating procedures, RACI charts, escalation matrices, and communication plans.
• Document incident timelines, investigative steps, evidence, findings, impact analysis, containment actions, recovery actions, and recommended corrective measures.
• Lead or support post-incident reviews and lessons-learned activities; assess the effectiveness of the Incident Response Plan (IRP), playbooks, and procedures, and recommend improvements.
• Assist with annual incident-response exercises, tabletop exercises, and technical tests; document test results, gaps, corrective actions, and updates to incident-response documentation.
• Produce accurate, timely incident reports, status updates, dashboards, executive summaries, and management briefings appropriate for technical and nontechnical stakeholders.
• Maintain familiarity with NIST SP 800-61 incident-handling guidance and apply it to daily incident-response operations.

Requirements

• Minimum of two (2) to five (5) years of progressively responsible experience in cybersecurity incident response, security operations, network security, application security, cloud security, threat detection, or a related discipline.
• Bachelor’s degree from an accredited college or university in cybersecurity, information assurance, computer science, information systems, computer engineering, network engineering, digital forensics, systems engineering, or a closely related technical discipline.
• One or more of the following current and active certifications:
  • EC-Council Certified Incident Handler (E|CIH)
  • Offensive Security Certified Professional (OSCP)
  • GIAC Certified Incident Handler (GCIH)
  • Current Splunk certification, such as Splunk Core Certified Power User, Splunk Enterprise Certified Admin, Splunk Core Certified Advanced Power User, or an equivalent Splunk security/engineering credential
• Ability to obtain and maintain a Public Trust clearance.

Skills

Candidates should demonstrate experience in:

• Security-event monitoring, alert triage, incident investigation, incident documentation, escalation, and response coordination.
• Enterprise incident-response processes, including preparation, detection and analysis, containment, eradication, recovery, and post-incident activities.
• Network security, web application security, cloud technologies, endpoint security, and security monitoring.
• Identifying vulnerable services, insecure ports and protocols, default or weak configurations, and common network/application security weaknesses.
• SIEM analysis, preferably Splunk, including log searches, dashboards, correlation, alert analysis, and report generation.
• IDS/IPS, firewalls, endpoint detection and response, vulnerability-management, and threat-detection technologies, including Palo Alto, FireEye or comparable platforms, and Tenable.
• Windows and Linux operating systems, including basic system/log analysis and security troubleshooting.
• NIST SP 800-61 and the creation or use of incident-response playbooks, RACI charts, escalation procedures, SOPs, and lessons-learned documentation.
• Preparing technical findings, incident reports, management updates, and executive-level summaries.

Desired Qualifications

• Master’s degree in cybersecurity, information assurance, computer science, digital forensics, information systems, engineering, data analytics, or a related technical discipline.
• Additional certifications such as:
  • GIAC Certified Intrusion Analyst (GCIA)
  • GIAC Security Essentials (GSEC)
  • GIAC Certified Forensic Analyst (GCFA)
  • GIAC Reverse Engineering Malware (GREM)
  • GIAC Penetration Tester (GPEN)
  • CompTIA Security+, CySA+, PenTest+, or CASP+
  • Certified Ethical Hacker (CEH)
  • Certified Information Systems Security Professional (CISSP)
  • Palo Alto Networks Certified Network Security Engineer (PCNSE) or related Palo Alto credential
  • Tenable/Nessus platform training or certification
  • FireEye, Trellix, Microsoft Defender, CrowdStrike, SentinelOne, or comparable EDR/XDR training
  • AWS Certified Security – Specialty
  • Microsoft Certified: Azure Security Engineer Associate
  • Google Professional Cloud Security Engineer
  • Cisco CyberOps Associate/Professional, CCNP Security, or equivalent network-security certification
  • ITIL Foundation, particularly for candidates supporting formal incident, problem, and change-management processes

Pay

$130,000 - $145,000/year

Schedule

Hybrid, 2-3 days per week on-site in Bethesda, MD.

Benefits

• 3 weeks of Personal Leave your first year
• 11 paid Holidays each year
• 5 days of Flexible Time Off each year for approved training or certifications (self-study is ineligible)
• 401(k) company match at 50% up to 10% of your salary
• Medical, Dental and Vision Insurance
• Life and Disability Insurance
• Public Transportation Subsidies
• Certifications and Training Allowance - Up to $5,000/year
• Bonus and profit-sharing opportunities, depending on company and employee performance