Senior Incident Response Analyst

About the role

The Senior Incident Response Analyst will support the DHS CISA Program, working within the DHS SOC to coordinate investigation and response efforts throughout the Incident Response lifecycle. They will correlate and analyze events and data to determine the scope of cyber incidents, acquire and analyze endpoint and network artifacts, and develop security content.

Responsibilities

• Coordinate investigation and response efforts throughout the Incident Response lifecycle
• Correlate and analyze events and data to determine scope of Cyber Incidents
• Acquire and analyze endpoint and network artifacts, volatile memory, malicious files/binaries and scripts
• Recognize attacker tactics, techniques, and procedures as potential indicators of compromise (IOCs)
• Develop, document, and maintain Incident Response process, procedures, workflows, and playbooks
• Tune and maintain security tools (EDR, IDS, SIEM, etc) to reduce false positives and improve SOC detection capabilities
• Document Investigation and Incident Response actions taken in Case Management Systems and prepare formal Incident Reports
• Create metrics and determine Key Performance Indicators to drive maturity of SOC operations

Requirements

• Bachelor’s degree in Computer Science, Engineering, Information Technology, Cyber Security, or related field and 12-15 years of related experience
• In-depth knowledge of each phase of the Incident Response life cycle
• Expertise of Operating Systems (Windows/Linux) operations and artifacts
• Expertise of Enterprise Network Architectures to include routing/switching, common protocols (DHCP, DNS, HTTP, etc), and devices (Firewalls, Proxies, Load Balancers, VPN, etc)
• Ability to recognize suspicious activity/events, common attacker TTPs, and perform logical analysis and research to determine root cause and scope of Incidents
• Experience with Cyber Kill Chain and ATT&CK Framework
• Scripting experience with Python, PowerShell, and/or Bash
• Flexible and adaptable self-starter with strong relationship-building skills
• Strong problem-solving abilities with an analytic and qualitative eye for reasoning
• Strong verbal and written communication skills
• Technical hands-on experience in incident detection and response, malware analysis, or computer forensics

Qualifications

• Favorable pass a 5-year (BI) Background Investigation
• One of the following certifications: SANS GIAC: GCIH, GCIA, GCFA, GPEN GCFE, GREM CISSP OSCP, OSCE, OSWP

Skills

• Expertise in Operating Systems (Windows/Linux) operations and artifacts
• Expertise in Enterprise Network Architectures to include routing/switching, common protocols (DHCP, DNS, HTTP, etc), and devices (Firewalls, Proxies, Load Balancers, VPN, etc)
• Ability to recognize suspicious activity/events, common attacker TTPs, and perform logical analysis and research to determine root cause and scope of Incidents
• Experience with Cyber Kill Chain and ATT&CK Framework
• Scripting experience with Python, PowerShell, and/or Bash

Benefits

Leidos offers a comprehensive benefits package including competitive compensation, Health and Wellness programs, Income Protection, Paid Leave, and Retirement.

Pay

$131,300.00 - $237,350.00

Schedule

Remote