Cybersecurity Analyst Lead (Incident Response)

Washington Metropolitan Area Transit Authority - Alexandria, VA

Full-time - Mid Level

Alexandria, VA

Transit and Ground Passenger Transportation

About the position

The Cybersecurity Analyst Lead (Incident Response) at the Washington Metropolitan Area Transit Authority (WMATA) is responsible for leading the incident response efforts within the Cyber Fusion Center. This role focuses on continuous monitoring, investigation, and remediation of security events to protect critical transit infrastructure. The analyst will develop processes for threat detection and response, optimize security tools, and provide mentorship to junior analysts. The position requires participation in on-call duties and collaboration with various teams to enhance the organization's cybersecurity posture.

Responsibilities

• Oversee the data analytics strategy based on the NIST Cybersecurity Framework.
• Analyze threat information from multiple sources and synthesize intelligence to identify vulnerabilities.
• Develop cyber threat indicators and monitor attacks and compromises.
• Coordinate the collection, processing, analysis, and dissemination of cyber threat assessments.
• Analyze events within WMATA's environments to mitigate threats using various cyber defense tools.
• Conduct strategic and operational effectiveness assessments for cyber events.
• Generate reports and action plans to support enhanced security procedures.
• Investigate and analyze incident response activities and ensure real-time cyber defense tasks are executed.
• Establish relationships between the incident response team and other internal and external groups.
• Manage the analysis of digital evidence and investigate computer security incidents.

Requirements

• Bachelor's degree from an accredited college or university.
• Six years of experience in cybersecurity, information systems security, or related fields.

Nice-to-haves

• Bachelor's Degree in Computer Science, Cybersecurity, or a related technical field.

Benefits

• Flexible work hours between virtual and in-person work as per the Authority's telework policy.