Incident Responder (2nd Shift)

We need to output only HTML fragment, no html/body tags, no markdown fences. Use

for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Include sections only if posting has real specific content. We have: - About the role: description paragraph about role, mission, etc. Yes. - Responsibilities: list of primary responsibilities. - Requirements: maybe combine qualifications? The posting has "Required Qualifications" and "Required Certifications". Could treat as Requirements section (or Qualifications). We need to decide headings: Use "Requirements" for required qualifications and certifications? Or separate "Qualifications" and "Skills"? The instruction: use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). We can choose which to include based on content. We have content for: - About the role: description paragraph. - Responsibilities: list. - Requirements: maybe "Required Qualifications" and "Required Certifications". Could be under Requirements. - Qualifications: maybe education/experience etc. Could be under Qualifications. - Skills: maybe list of technical skills (SIEM, NIDPS, scripting, etc.) Could be under Skills. - Benefits: posting mentions "Pay and benefits are fundamental..." but no specific benefits listed besides generic statement. It says "Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement." That's somewhat generic but still specific? It mentions types. Could include Benefits section with those items. - Pay: posting includes Pay Range $107,900.00 - $195,050.00. So we can include Pay section. - Schedule: posting includes Work Hours: 1530 – 2330, occasional floater shifts. So we can include Schedule. We must not include headings with filler like "commensurate with experience". Not needed. We must preserve all substantive information, not invent or summarize away detail. So we need to include all details from posting, but we can format as lists. We must remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, application instructions. So we need to cut out the scam warning, commitment to non-discrimination, etc. Also remove "Original Posting September 15, 2026", "For U.S. Positions: While subject to change..." etc. Also remove "Leidos is an industry and technology leader..." etc. Also remove "Pay And Benefits" generic paragraph? But we need to keep benefits specifics: "Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement." That's from the Pay and benefits section. We'll keep that as benefits list. We also need to keep the pay range. We need to keep location, clearance, shift hours. We need to keep the description about role. We need to keep responsibilities list. We need to keep required qualifications (education/experience, clearance, experience, etc.) We need to keep required certifications list. We need to keep skills: list of SIEM, NIDPS, host based tools, scripting languages, penetration testing tools, ticketing systems, report writing, intelligence gathering. We need to keep any other specifics like "Coordinate and communicate with internal and external stakeholders, including Special Security Officers (SSOs), Judge Advocate General (JAG), ONI ISSM, Hopper ISSM, CNI, NAVNETWARCOM, IC SCC, NCDOC, NCIS, and other IC and DoD SOC/DCO teams." That's part of responsibilities. We need to keep "Prepare and submit Electronic Spillage Assessment Forms (ESAFs) to the NNWC Electronic Spillage Center." We need to keep "Monitor Data Loss Prevention (DLP) outputs for classified code words and potential spillage indicators." We need to keep "Maintain detailed and accurate incident documentation and timelines throughout the response process." We need to keep "Participate in incident response meetings, briefings, and after action reviews." We need to keep "Support the execution and evaluation of annual security exercises." We need to keep "Receive and act on escalations from Tier 1 analysts, conduct spillage response and cleanup activities, and support incident response for TS/SCI networks, including JWICS, ATLAS, and other networks for which HGCC is responsible." We need to keep "Receive and respond to incident notifications from customers via telephone and email." We need to keep "Work Location Hours: This is a 2nd shift position with regular work hours of 1530 – 2330. Occasional floater shifts or coverage outside of these hours may be required based on program and staffing needs." We need to keep location: Suitland, MD. We need to keep clearance: Active TS/SCI. We need to keep the job title? Not as heading. We need to keep the description about role: "Leidos is seeking an Incident Responder (2nd Shift) to join a mission focused cybersecurity team supporting the Office of Naval Intelligence (ONI) at the Hopper Global Communications Center (HGCC) in Suitland, MD. In this role, you will serve as a digital first responder, helping defend the Navy's critical maritime intelligence networks against cyber threats. You will respond to and investigate cybersecurity incidents, contain affected systems, limit operational impact, and collect and analyze digital artifacts to support effective response and recovery. Working across the incident response lifecycle, you will collaborate with cybersecurity, intelligence, and investigative partners to help protect highly sensitive TS/SCI environments." We need to keep that as About the role. Now we need to output HTML fragment with headings

and content. We should not repeat job title as heading. We need to include maybe a short paragraph for metadata like location, clearance, shift? Could be part of About the role or a separate meta? The instruction: do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short

or drop it. So we can include location, clearance, shift hours in a short

maybe under About the role or separate? Probably better to include them in About the role paragraph. We'll craft:

About the role

Leidos is seeking an Incident Responder (2nd Shift) to join a mission focused cybersecurity team supporting the Office of Naval Intelligence (ONI) at the Hopper Global Communications Center (HGCC) in Suitland, MD. The position requires an active TS/SCI clearance and operates on 2nd shift (1530–2330) with occasional floater shifts. In this role, you will serve as a digital first responder, helping defend the Navy's critical maritime intelligence networks against cyber threats. You will respond to and investigate cybersecurity incidents, contain affected systems, limit operational impact, and collect and analyze digital artifacts to support effective response and recovery. Working across the incident response lifecycle, you will collaborate with cybersecurity, intelligence, and investigative partners to help protect highly sensitive TS/SCI environments.

Then Responsibilities:

Responsibilities

• Perform all phases of the incident response lifecycle, including detection, analysis, containment, eradication, and recovery.
• Receive and act on escalations from Tier 1 analysts, conduct spillage response and cleanup activities, and support incident response for TS/SCI networks, including JWICS, ATLAS, and other networks for which HGCC is responsible.
• Receive and respond to incident notifications from customers via telephone and email.
• Prepare and submit Electronic Spillage Assessment Forms (ESAFs) to the NNWC Electronic Spillage Center.
• Monitor Data Loss Prevention (DLP) outputs for classified code words and potential spillage indicators.
• Coordinate and communicate with internal and external stakeholders, including Special Security Officers (SSOs), Judge Advocate General (JAG), ONI ISSM, Hopper ISSM, CNI, NAVNETWARCOM, IC SCC, NCDOC, NCIS, and other IC and DoD SOC/DCO teams.
• Maintain detailed and accurate incident documentation and timelines throughout the response process.
• Participate in incident response meetings, briefings, and after action reviews.
• Support the execution and evaluation of annual security exercises.

Then Requirements (maybe combine qualifications and certifications). But we have separate headings: Requirements, Qualifications, Skills. Let's allocate:

Requirements

Active TS/SCI security clearance.

Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Information Assurance, or a related area of study desired with 8+ years of experience or Master’s degree with 6+ years of experience. Additional experience may be considered in lieu of a degree.
• Extensive experience in the Computer Network Defense (CND) discipline.
• Significant professional experience monitoring, analyzing, and investigating alerts generated by cybersecurity tools.

Skills

• Experience with Security Information and Event Management (SIEM) systems such as Splunk and Elastic.
• Experience with Network Intrusion Detection/Prevention Systems (NIDPS), such as Cisco FirePower and Palo Alto NGFW, as well as host based tools such as Trellix ePO, Microsoft Defender, and Tanium.
• Knowledge of scripting and coding languages such as Python, Perl, Ruby, JavaScript, PowerShell, C, C++, and Java.
• Knowledge of penetration testing and red team tactics, techniques, and procedures, as well as tools such as Kali, SamuraiWTF, Nmap, Burp Suite, sqlmap, and Metasploit.
• Knowledge of ticketing systems, report writing, and intelligence gathering, analysis, and dissemination techniques specific to cybersecurity.

Certifications

maybe we could include under Requirements or Qualifications. But we have heading "Certifications" not in the list but we could treat as part of Requirements. The instruction list includes only those headings; we could include Certifications under Requirements or Qualifications. Better to include under Requirements as a list. But we already used Requirements for clearance only. Could expand Requirements to include certifications. Let's restructure:

Requirements

• Active TS/SCI security clearance.
• Must possess one of the following certifications or obtain one within 30 days of accepting an offer: Certified Ethical Hacker (CEH), CyberSec First Responder (CFR), CompTIA Cybersecurity Analyst (CySA+), GIAC Certified Forensic Analyst (GCFA), GIAC Certified Incident Handler (GCIH), EC Council Certified Incident Handler (ECIH), or Cisco Cybersecurity Specialist (SCYBER).

Then Qualifications for education/experience and CND experience. Then Skills for technical skills. Then Benefits:

Benefits

• Competitive compensation
• Health and Wellness programs
• Income Protection
• Paid Leave
• Retirement

Pay:

Pay

Pay Range: $107,900.00 - $195,050.00 (Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary.)

Schedule:

Schedule

Regular work hours: 1530 – 2330 (2nd shift). Occasional floater shifts or coverage outside of these hours may be required based on program and staffing needs.

We need to ensure we didn't include any boilerplate like "Original Posting September 15, 2026",