Incident Response Analysts

• Recognize potential intrusion attempts, malicious activity, or other cybersecurity conditions requiring immediate investigation or mitigation.\n
• Assess cybersecurity events to determine scope, potential impact, affected systems, and required response actions.\n
• Support containment and mitigation of active cybersecurity threats in accordance with approved Government procedures.\n
• Coordinate eradication and recovery activities with system owners, administrators, network personnel, cybersecurity teams, and other technical stakeholders.\n
• Collect and preserve technical evidence associated with cybersecurity events and incidents.\n
• Maintain complete and accurate incident records, timelines, supporting evidence, investigative findings, response actions, and status information.\n
• Develop and contribute to required cybersecurity event and incident reporting.\n
• Coordinate incident-response activities with Security Operations Center analysts, Cybersecurity Service Providers (CSSPs), system owners, technical teams, and Government stakeholders.\n
• Support escalation of significant cybersecurity events and incidents in accordance with established procedures.\n
• Provide timely status updates during active investigations and incident-response activities.\n
• Support post-incident analysis and lessons learned to identify opportunities to improve monitoring, detection, response procedures, and defensive capabilities.\n
• Participate in after-hours incident response when assigned and meet the contract-required one-hour recall requirement.\n

• Bachelor’s degree and 4 or more years of relevant cybersecurity experience.\n
• Experience supporting cybersecurity incident response, Security Operations Center operations, cyber defense, or security-event investigation.\n
• Experience performing analysis of cybersecurity events and determining appropriate response or escalation actions.\n
• Experience supporting incident containment, eradication, recovery, and post-incident activities.\n
• Experience monitoring and analyzing enterprise cybersecurity tools and security telemetry.\n
• Experience documenting incident timelines, investigative findings, evidence, response actions, and status.\n
• Experience coordinating cybersecurity incidents across technical teams and stakeholder organizations.\n
• Working knowledge of network, endpoint, and enterprise cybersecurity monitoring concepts.\n
• Ability to recognize potential intrusion activity and support rapid mitigation of cybersecurity threats.\n
• Ability to communicate clearly during active cybersecurity incidents and maintain accurate documentation under time-sensitive conditions.\n
• Ability to support after-hours incident response and the required one-hour recall when assigned.\n
• U.S. Citizenship required.\n
• Active Secret security clearance required.\n, * Experience supporting cybersecurity incident response within Department of Defense or Federal environments.\n
• Experience responding to incidents in both unclassified and classified network environments.\n
• Experience with Security Information and Event Management platforms and enterprise security-monitoring capabilities.\n
• Experience analyzing endpoint-security, firewall, Intrusion Detection System, Intrusion Prevention System, web-security, antispam, or malware-prevention data.\n
• Experience supporting evidence collection and preservation during cybersecurity investigations.\n
• Experience coordinating incident response with Security Operations Center personnel, Cybersecurity Service Providers, system owners, network teams, and other technical organizations.\n
• Experience operating in a 24x7 cybersecurity operations environment or supporting after-hours incident response.\n
• Familiarity with Department of Defense cybersecurity incident-response processes and requirements.\n
• Familiarity with DHRA, DMDC, or comparable Department of Defense enterprise environments.\n

The DHRA Information Technology (IT) environment includes approximately 15,000 network and endpoint devices supporting more than 600 Government-Off-The-Shelf (GOTS) applications and approximately 100 Risk Management Framework (RMF) authorization boundaries managed through the Enterprise Mission Assurance Support Service (eMASS). Incident-response operations support both the Non-classified Internet Protocol Router Network (NIPRNet) and Secret Internet Protocol Router Network (SIPRNet) environments. Analysts must be able to move quickly from security-event identification into investigation and coordinated response while maintaining accurate records, preserving evidence, and keeping Government stakeholders informed.\n \n \n \n

• Primary Tasks\n
• Support preparation, detection, analysis, containment, eradication, recovery, and post-incident activities for cybersecurity events and incidents.\n
• Investigate cybersecurity incidents affecting NIPRNet and SIPRNet environments.\n
• Perform proactive security monitoring and analysis to identify potential intrusion attempts and other malicious activity.\n