Incident Responder (3rd Shift)
maybe. Then: "Leidos is seeking an Incident Responder (3rd Shift) to join a mission focused cybersecurity team supporting the Office of Naval Intelligence (ONI) at the Hopper Global Communications Center (HGCC) in Suitland, MD. In this role, you will serve as a digital first responder, helping defend the Navy's critical maritime intelligence networks against cyber threats. You will respond to and investigate cybersecurity incidents, contain affected systems, limit operational impact, and collect and analyze digital artifacts to support effective response and recovery. Working across the incident response lifecycle, you will collaborate with cybersecurity, intelligence, and investigative partners to help protect highly sensitive TS/SCI environments." That's about the role. Then "Work Schedule: This is a 3rd shift position with regular work hours of 2330 – 0730. Occasional floater shifts or coverage outside of these hours may be required based on program and staffing needs." Then "Primary Responsibilities" list. Then "Required Qualifications" paragraph. Then "Required Certifications" list. Then "NITESONI DABAOPP1" maybe irrelevant. Then "If you're looking for comfort, keep scrolling..." etc. That's fluff, we can ignore. Then "Original Posting September 15, 2026" etc. Then "Pay Range Pay Range $107,900.00 - $195,050.00" etc. Then "About Leidos" etc. Then "Pay And Benefits" paragraph. Then "Securing Your Data" etc. Then "Commitment to Non-Discrimination" etc. We need to remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, application instructions. So we should remove sections like "Securing Your Data", "Commitment to Non-Discrimination", "About Leidos", "Original Posting", "Pay And Benefits" maybe we keep Pay and Benefits? The instruction: include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text (e.g., "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless the posting actually states them. We have Pay Range specific numbers, so we can include Pay section with that range. Benefits: The posting mentions "Pay and benefits are fundamental..." then lists generic benefits but not specific details. It says "Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement. More details are available at www.leidos.com/careers/pay-benefits." That's somewhat generic but still specific? It lists types of benefits. Might be considered specific enough? The instruction says prefer a few substantive sections over many thin ones. Could include Benefits section with those bullet points. Schedule: we have specific hours 2330 – 0730, occasional floater shifts. So we can include Schedule section. Now headings: Use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). We need to decide which sections to include.
We have:
- About the role: we have description paragraph.
- Responsibilities: list of duties.
- Requirements: maybe combine Required Qualifications and Required Certifications? The instruction says separate headings: Requirements, Qualifications, Skills. Could treat Required Qualifications as Requirements, and maybe Skills from knowledge list? But we have a list of knowledge/experience under Required Qualifications. Could split: Requirements (education/experience), Qualifications (certifications), Skills (technical knowledge). Let's see.
The posting: "Required Qualifications Bachelor's degree ... Active TS/SCI security clearance.Extensive experience in the Computer Network Defense (CND) discipline.Significant professional experience monitoring, analyzing, and investigating alerts generated by cybersecurity tools.Experience with Security Information and Event Management (SIEM) systems such as Splunk and Elastic.Experience with Network Intrusion Detection/Prevention Systems (NIDPS), such as Cisco FirePower and Palo Alto NGFW, as well as host based tools such as Trellix ePO, Microsoft Defender, and Tanium.Knowledge of scripting and coding languages such as Python, Perl, Ruby, JavaScript, PowerShell, C, C++, and Java.Knowledge of penetration testing and red team tactics, techniques, and procedures, as well as tools such as Kali, SamuraiWTF, Nmap, Burp Suite, sqlmap, and Metasploit.Knowledge of ticketing systems, report writing, and intelligence gathering, analysis, and dissemination techniques specific to cybersecurity."
Then "Required Certifications Must possess one of the following certifications or obtain one within 30 days of accepting an offer: Certified Ethical Hacker (CEH), CyberSec First Responder (CFR), CompTIA Cybersecurity Analyst (CySA+), GIAC Certified Forensic Analyst (GCFA), GIAC Certified Incident Handler (GCIH), EC Council Certified Incident Handler (ECIH), or Cisco Cybersecurity Specialist (SCYBER)."
Thus we can map:
- Requirements: education/experience/clearance etc.
- Qualifications: certifications.
- Skills: knowledge of tools/languages etc.
But the posting lumps knowledge of tools etc under Required Qualifications. However we can still separate for better structure. The instruction: "Prefer a few substantive sections over many thin ones." Might be better to combine Requirements and Qualifications into one? But they ask to use headings for those categories if content exists. We have content for each.
Let's create sections:
About the role
with paragraph.
Responsibilities
with - list.
Requirements
with - list: Bachelor's degree ... 8+ years experience or Master's with 6+ years, Active TS/SCI clearance, extensive CND experience, experience monitoring/analyzing/investigating alerts.
Qualifications
with - list of certifications.
Skills
with - list: SIEM (Splunk, Elastic), NIDPS (Cisco FirePower, Palo Alto NGFW), host tools (Trellix ePO, Microsoft Defender, Tanium), scripting languages (Python, Perl, Ruby, JavaScript, PowerShell, C, C++, Java), penetration testing/red team tools (Kali, SamuraiWTF, Nmap, Burp Suite, sqlmap, Metasploit), ticketing systems, report writing, intelligence gathering.
We could also include knowledge of penetration testing etc.
Pay
with Pay Range $107,900.00 - $195,050.00
Schedule
with This is a 3rd shift position with regular work hours of 2330 – 0730. Occasional floater shifts or coverage outside of these hours may be required based on program and staffing needs.
Benefits
with - competitive compensation, Health and Wellness programs, Income Protection, Paid Leave, Retirement.
maybe.
We need to ensure we don't repeat job title as heading. We already not.
We need to drop minor metadata like location, clearance, work hours into a short or drop it. We already have schedule section covering work hours; location and clearance could be in a short
under About the role maybe. But we could include a short
at top: "Location: Suitland, MD. Clearance: Active TS/SCI." That's minor metadata.
Let's craft HTML.
We must output only HTML fragment, no /, no markdown fences.
Let's produce:
Location: Suitland, MD. Clearance: Active TS/SCI.
About the role
Leidos is seeking an Incident Responder (3rd Shift) to join a mission focused cybersecurity team supporting the Office of Naval Intelligence (ONI) at the Hopper Global Communications Center (HGCC) in Suitland, MD. In this role, you will serve as a digital first responder, helping defend the Navy's critical maritime intelligence networks against cyber threats. You will respond to and investigate cybersecurity incidents, contain affected systems, limit operational impact, and collect and analyze digital artifacts to support effective response and recovery. Working across the incident response lifecycle, you will collaborate with cybersecurity, intelligence, and investigative partners to help protect highly sensitive TS/SCI environments.
Responsibilities
- Perform all phases of the incident response lifecycle, including detection, analysis, containment, eradication, and recovery.
- Receive and act on escalations from Tier 1 analysts, conduct spillage response and cleanup activities, and support incident response for TS/SCI networks, including JWICS, ATLAS, and other networks for which HGCC is responsible.
- Receive and respond to incident notifications from customers via telephone and email.
- Prepare and submit Electronic Spillage Assessment Forms (ESAFs) to the NNWC Electronic Spillage Center.
- Monitor Data Loss Prevention (DLP) outputs for classified code words and potential spillage indicators.
- Coordinate and communicate with internal and external stakeholders, including Special Security Officers (SSOs), Judge Advocate General (JAG), ONI ISSM, Hopper ISSM, CNI, NAVNETWARCOM, IC SCC, NCDOC, NCIS, and other IC and DoD SOC/DCO teams.
- Maintain detailed and accurate incident documentation and timelines throughout the response process.
- Participate in incident response meetings, briefings, and after action reviews.
- Support the execution and evaluation of annual security exercises.
Requirements
- Bachelor's degree in Cybersecurity, Information Technology, Information Assurance, or a related area of study desired with 8+ years of experience or Master’s degree with 6+ years of experience. Additional experience may be considered in lieu of a degree.
- Active TS/SCI security clearance.
- Extensive experience in the Computer Network Defense (CND) discipline.
- Significant professional experience monitoring, analyzing, and investigating alerts generated by cybersecurity tools.
Qualifications
- Must possess one of the following certifications or obtain one within 30 days of accepting an offer: Certified Ethical Hacker (CEH), CyberSec First Responder (CFR), CompTIA Cybersecurity Analyst (CySA+), GIAC Certified Forensic Analyst (GCFA), GIAC Certified Incident Handler (GCIH), EC Council Certified Incident Handler (ECIH), or Cisco Cybersecurity Specialist (SCYBER).
Skills
- Experience with Security Information and Event Management (SIEM) systems such as Splunk and Elastic.
- Experience with Network Intrusion Detection/Prevention Systems (NIDPS), such as Cisco FirePower and Palo Alto NGFW, as well as host based tools such as Trellix ePO, Microsoft Defender, and Tanium.
Requirements
with- list: Bachelor's degree ... 8+ years experience or Master's with 6+ years, Active TS/SCI clearance, extensive CND experience, experience monitoring/analyzing/investigating alerts.
Qualifications
with- list of certifications.
Skills
with- list: SIEM (Splunk, Elastic), NIDPS (Cisco FirePower, Palo Alto NGFW), host tools (Trellix ePO, Microsoft Defender, Tanium), scripting languages (Python, Perl, Ruby, JavaScript, PowerShell, C, C++, Java), penetration testing/red team tools (Kali, SamuraiWTF, Nmap, Burp Suite, sqlmap, Metasploit), ticketing systems, report writing, intelligence gathering.
We could also include knowledge of penetration testing etc.
Pay
withPay Range $107,900.00 - $195,050.00
Schedule
withThis is a 3rd shift position with regular work hours of 2330 – 0730. Occasional floater shifts or coverage outside of these hours may be required based on program and staffing needs.
Benefits
with- competitive compensation, Health and Wellness programs, Income Protection, Paid Leave, Retirement.
or drop it. We already have schedule section covering work hours; location and clearance could be in a short
under About the role maybe. But we could include a short
at top: "Location: Suitland, MD. Clearance: Active TS/SCI." That's minor metadata. Let's craft HTML. We must output only HTML fragment, no /, no markdown fences. Let's produce:
Location: Suitland, MD. Clearance: Active TS/SCI.
About the role
Leidos is seeking an Incident Responder (3rd Shift) to join a mission focused cybersecurity team supporting the Office of Naval Intelligence (ONI) at the Hopper Global Communications Center (HGCC) in Suitland, MD. In this role, you will serve as a digital first responder, helping defend the Navy's critical maritime intelligence networks against cyber threats. You will respond to and investigate cybersecurity incidents, contain affected systems, limit operational impact, and collect and analyze digital artifacts to support effective response and recovery. Working across the incident response lifecycle, you will collaborate with cybersecurity, intelligence, and investigative partners to help protect highly sensitive TS/SCI environments.
Responsibilities
- Perform all phases of the incident response lifecycle, including detection, analysis, containment, eradication, and recovery.
- Receive and act on escalations from Tier 1 analysts, conduct spillage response and cleanup activities, and support incident response for TS/SCI networks, including JWICS, ATLAS, and other networks for which HGCC is responsible.
- Receive and respond to incident notifications from customers via telephone and email.
- Prepare and submit Electronic Spillage Assessment Forms (ESAFs) to the NNWC Electronic Spillage Center.
- Monitor Data Loss Prevention (DLP) outputs for classified code words and potential spillage indicators.
- Coordinate and communicate with internal and external stakeholders, including Special Security Officers (SSOs), Judge Advocate General (JAG), ONI ISSM, Hopper ISSM, CNI, NAVNETWARCOM, IC SCC, NCDOC, NCIS, and other IC and DoD SOC/DCO teams.
- Maintain detailed and accurate incident documentation and timelines throughout the response process.
- Participate in incident response meetings, briefings, and after action reviews.
- Support the execution and evaluation of annual security exercises.
Requirements
- Bachelor's degree in Cybersecurity, Information Technology, Information Assurance, or a related area of study desired with 8+ years of experience or Master’s degree with 6+ years of experience. Additional experience may be considered in lieu of a degree.
- Active TS/SCI security clearance.
- Extensive experience in the Computer Network Defense (CND) discipline.
- Significant professional experience monitoring, analyzing, and investigating alerts generated by cybersecurity tools.
Qualifications
- Must possess one of the following certifications or obtain one within 30 days of accepting an offer: Certified Ethical Hacker (CEH), CyberSec First Responder (CFR), CompTIA Cybersecurity Analyst (CySA+), GIAC Certified Forensic Analyst (GCFA), GIAC Certified Incident Handler (GCIH), EC Council Certified Incident Handler (ECIH), or Cisco Cybersecurity Specialist (SCYBER).
Skills
- Experience with Security Information and Event Management (SIEM) systems such as Splunk and Elastic.
- Experience with Network Intrusion Detection/Prevention Systems (NIDPS), such as Cisco FirePower and Palo Alto NGFW, as well as host based tools such as Trellix ePO, Microsoft Defender, and Tanium.
- list: SIEM (Splunk, Elastic), NIDPS (Cisco FirePower, Palo Alto NGFW), host tools (Trellix ePO, Microsoft Defender, Tanium), scripting languages (Python, Perl, Ruby, JavaScript, PowerShell, C, C++, Java), penetration testing/red team tools (Kali, SamuraiWTF, Nmap, Burp Suite, sqlmap, Metasploit), ticketing systems, report writing, intelligence gathering.
We could also include knowledge of penetration testing etc.
- list of certifications.