Description
The Digital Modernization Sector at Leidos is seeking a Senior Incident Response Analyst to support the DHS CISA Program. The successful candidate will be part of a team responsible for monitoring, detecting, analyzing, mitigating, and responding to cyber threats and adversarial activity on the DHS Enterprise.
The Senior Incident Response Analyst will:
- Coordinate investigation and response efforts throughout the Incident Response lifecycle
- Correlate and analyze events and data to determine the scope of Cyber Incidents
- Acquire and analyze endpoint and network artifacts, volatile memory, malicious files/binaries, and scripts
- Recognize attacker tactics, techniques, and procedures as potential indicators of compromise (IOCs) that can be used to improve monitoring, analysis, and Incident Response
- Develop, document, and maintain Incident Response processes, procedures, workflows, and playbooks
- Tune and maintain security tools (EDR, IDS, SIEM, etc.) to reduce false positives and improve SOC detection capabilities
- Document Investigation and Incident Response actions taken in Case Management Systems and prepare formal Incident Reports
- Create metrics and determine Key Performance Indicators to drive maturity of SOC operations
- Develop security content such as scripts, signatures, and alerts
The basic qualifications for this role include:
- Bachelor's degree in Computer Science, Engineering, Information Technology, Cyber Security, or a related field
- 12-15 years of related experience
- In-depth knowledge of each phase of the Incident Response life cycle
- Expertise in Operating Systems (Windows/Linux) operations and artifacts
- Expertise in Enterprise Network Architectures, including routing/switching, common protocols, and devices
- Ability to recognize suspicious activity/events, common attacker TTPs, and perform logical analysis and research to determine root cause and scope of Incidents
- Expertise with Cyber Kill Chain and utilization of the ATT&CK Framework
- Scripting experience with Python, PowerShell, and/or Bash
- Ability to independently prioritize and complete multiple tasks with little to no supervision
- Flexible and adaptable self-starter with strong relationship-building skills
- Strong problem-solving abilities with an analytic and qualitative eye for reasoning
- Strong verbal and written communication skills
- Ability to communicate with all levels of audiences
Preferred qualifications include experience in cyber government and/or federal law enforcement FISMA systems.
The pay range for this position is $131,300.00 - $237,350.00.