Primary Responsibilities

• Knowledge of each phase of the Incident Response life cycle

• Understanding of Operating Systems (Windows/Linux) operations and artifacts

• Understanding of Enterprise Network Architectures to include routing/switching, common protocols (DHCP, DNS, HTTP, etc), and devices (Firewalls, Proxies, Load Balancers, VPN, etc)

• Ability to recognize suspicious activity/events, common attacker TTPs, perform logical analysis and research to determine root cause and scope of Incidents

• Drive implementation and improvement of new tools, capabilities, frameworks, and methodologies

• Instill and reinforce industry best practices in the domains of incident response, cybersecurity analysis, case and knowledge management, and SOC operations

• Promote and drive implementation of automation and process efficiencies

• Familiarity with Cyber Kill Chain and ATT&CK Framework and how to leverage in Security Operations

• Provide guidance and mentorship to improve analyst skill sets and ensure delivery of high quality analysis and work products

• Establish trust and business relationships with customer and other relevant stakeholders

Basic Qualifications

• All Incident Response Analyst candidates shall have a minimum of a bachelor’s degree in Computer Science, Engineering, Information Technology, Cybersecurity, and 4-8 years of experience in incident detection and response, malware analysis, or cyber forensics. Additional education and certifications may be considered in lieu of a degree.

• Must have TS/SCI. In addition to specific security clearance requirements, all Department of Homeland Security SOC employees are required to obtain an Entry on Duty (EOD) clearance to support this program. 

• understanding of core current cybersecurity technologies as well as emerging capabilities.

• 4+ years of intrusion detection and/or incident handling experience

• CISSP or SANS GCIH or GCIA required upon start

• Knowledge in planning, directing, and managing Computer Incident Response Team (CIRT) and/or Security Operations Center (SOC) operations for a large and complex Enterprise

• Strong written and verbal communication skills, and the ability to create technical reports based on analytical findings.

• Strong analytical and troubleshooting skills.

Preferred Qualifications

• Hands-on cybersecurity experience (Protect, Detect, Respond and Sustain) within a Computer Incident Response organization including prior experience performing large-scale incident response.

• Demonstrated understanding of the life cycle of cybersecurity threats, attacks, attack vectors and methods of exploitation with an understanding of intrusion set tactics, techniques and procedures (TTPs).

• Familiarity or experience in Intelligence Driven Defense, Cyber Kill Chain methodology, and/or MITRE ATT&CK framework.

• Familiarity with Cloud concepts and experience performing monitoring and responding to threats in Cloud environments