IR Specialist

About the role

Nightwing provides technically advanced full‑spectrum cyber, data operations, systems integration and intelligence mission support services. As part of the Engagement Support Services (ESS) contract, the JCDC Cyber Triage Analyst will support a U.S. Government customer by rapidly deploying and managing secure cloud‑based engagement kits for cyber incident response and threat hunting. The analyst serves as a frontline defender, performing initial analysis and triage of cyber threat reports, indicators of compromise (IOCs), and incident notifications submitted to the JCDC.

Responsibilities

• Perform initial triage and assessment of incoming cyber threat tickets, incident reports, and IOC submissions.
• Analyze technical data including IP addresses, domain names, file hashes, network traffic patterns, and malware artifacts.
• Determine threat severity, credibility, and potential impact to critical infrastructure sectors.
• Enrich IOCs using threat intelligence platforms, open‑source intelligence (OSINT), and government‑exclusive resources.
• Prepare concise triage reports with actionable recommendations for escalation or further analysis.
• Route tickets to appropriate JCDC teams, CISA divisions, or interagency partners based on assessment findings.
• Coordinate with sector‑specific analysts and interagency liaisons to gather additional context.
• Maintain accurate documentation in ticketing systems and knowledge‑management platforms.
• Participate in shift handoffs and contribute to daily operational briefings.
• Support development of triage playbooks and standard operating procedures.
• Monitor emerging threat campaigns and trending adversary activity.
• Provide feedback to submitters and partner organizations on ticket status and outcomes.

Required Skills

• U.S. citizenship.
• Active Top Secret clearance with SCI eligibility.
• Ability to obtain DHS Suitability.
• 3–5 years of progressive experience in threat intelligence, SOC operations, or cyber incident response.
• Ability to work collaboratively across physical locations.

Desired Skills

• Prior experience in federal government cybersecurity roles (CISA, FBI, NSA, DoD).
• Understanding of the CISA NCISS National Cyber Incident Scoring System.
• Knowledge of general attack stages (e.g., footprinting, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks).
• Experience recognizing and categorizing vulnerabilities and associated attacks.
• Familiarity with Computer Network Defense policies, procedures, and regulations.
• Understanding of different operational threat environments (script kiddies, non‑nation‑state sponsored, nation‑state sponsored).
• Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross‑site scripting, SQL injection, race conditions, covert channel, replay, return‑oriented attacks, malicious code).
• Experience with SIEM platforms, threat intelligence platforms (TIP), and ticketing systems.
• Knowledge of critical infrastructure sectors and associated cyber risks.
• Familiarity with DHS/CISA products and services.

Desired Certifications

• Security+
• CySA+
• GCIH
• GCIA
• Or similar certifications.

Salary & Benefits

The salary range for this position is $77,000–$163,000, determined by qualifications, experience, and expertise. Nightwing offers medical, vision, and dental insurance, a 401(k) plan, paid time off, holidays, and additional insurance options.