Senior Incident Response Analyst

$122,200 - $220,900/Yr

Leidos - Arlington, VA

Full-time - Senior

Arlington, VA

Professional, Scientific, and Technical Services

About the position

The Senior Incident Response Analyst at Leidos plays a crucial role in supporting the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (DHS CISA) Program. This position involves monitoring, detecting, analyzing, mitigating, and responding to cyber threats and incidents within the DHS Security Operations Center (SOC). The analyst will coordinate incident response efforts, analyze cyber incidents, and enhance the SOC's capabilities through effective communication and documentation.

Responsibilities

• Coordinate investigation and response efforts throughout the Incident Response lifecycle
• Correlate and analyze events and data to determine the scope of Cyber Incidents
• Acquire and analyze endpoint and network artifacts, volatile memory, malicious files/binaries, and scripts
• Recognize attacker tactics, techniques, and procedures as potential indicators of compromise (IOCs)
• Develop, document, and maintain Incident Response processes, procedures, workflows, and playbooks
• Tune and maintain security tools (EDR, IDS, SIEM, etc.) to reduce false positives and improve SOC detection capabilities
• Document Investigation and Incident Response actions in Case Management Systems and prepare formal Incident reports
• Create metrics and determine Key Performance Indicators to drive maturity of SOC operations
• Develop security content such as scripts, signatures, and alerts

Requirements

• Bachelor's degree in Computer Science, Engineering, Information Technology, Cyber Security, or related field
• 12-15 years of related experience, with additional years of experience and/or cyber certifications considered in lieu of degree
• In-depth knowledge of each phase of the Incident Response lifecycle
• Expertise in Operating Systems (Windows/Linux) operations and artifacts
• Expertise in Enterprise Network Architectures including routing/switching, common protocols (DHCP, DNS, HTTP, etc.), and devices (Firewalls, Proxies, Load Balancers, VPN, etc.)
• Ability to recognize suspicious activity/events and common attacker TTPs
• Expertise with Cyber Kill Chain and utilization of the ATT&CK Framework
• Scripting experience with Python, PowerShell, and/or Bash
• Ability to independently prioritize and complete multiple tasks with little to no supervision
• Strong problem-solving abilities and analytical skills
• Strong verbal and written communication skills
• Ability to communicate with all levels of audiences (subordinates, peers & leadership)
• Technical hands-on experience in incident detection and response, malware analysis, or computer forensics

Nice-to-haves

• Experience in cyber government and/or federal law enforcement FISMA systems