AOUSC - Incident Response Analyst

cFocus Software seeks a Incident Response Analyst (Tier 2) to join our program supporting the Administrative Office of the United States Courts (AOUSC). This position is Hybrid with the onsite location being in Washington, DC. This position requires a Public Trust clearance.

• Active Public Trust clearance
• B.S. Computer Science, Information Technology, or a related field
• 3+ years of experience in an IR role.
• 2+ years' experience using Python and PowerShell scripts for decoding/decryption of obfuscated payloads.
• 2 years of experience in performing live triage, log correlation, detection rule refinement, to include usage of Velociraptor, Splunk ES and Sentinel.
• 1 year of experience in federal incident handling guidelines as specified in NIST CSWP-29: CSF, and NIST SP-800-61 Computer Security Incident Handling Guide.
• Active SANS GCIH or GCIA certification

Invitation for Job Applicants to Self-Identify as a U.S. Veteran

• A "disabled veteran" is one of the following:

• a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or
• a person who was discharged or released from active duty because of a service-connected disability.

• A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.
• An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.
• An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.