> Markdown version of [/jobs/ext/3673113-cyber-incident-analyst-responder-regional-cnda-26-457-space-aht](https://www.wearedevelopers.com/jobs/ext/3673113-cyber-incident-analyst-responder-regional-cnda-26-457-space-aht). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cyber Incident Analyst Responder - Regional CNDA (26-457) Space AHT - **Company:** Northrop Grumman - **Location:** Colorado Springs, CO, United States - **Salary:** $75,800.0 - $113,800.0 - **Contract:** Permanent contract - **Skills:** Systems Engineering, Unix, Client Server Models, Cyber Security, Information Systems, Computer Networks, Networking Hardware, Intrusion Detection and Prevention, Intrusion Detection Systems, Network Security, Log Analysis, Microsoft Operating Systems, Networking Basics, Network Intrusion Detection Systems, Network Administration, ArcSight SIEM Tool, Software Engineering, Tripwire, Wide Area Networks, Network Routers, Multiplexers, Firewalls (Computer Science), Information Technology, Cybercrime, Operational Systems, Network Server, Vulnerability Analysis - **Published:** October 10, 2026 - **Apply:** https://www.careerjet.com/job/us90a478e40db1e1d19a96bdc1bbe952f7/eaa ## About the Role Please list your current security clearance and IAT or relevant certifications on your resume, if applicable. * A Bachelor's Degree in Computer Science, Software Engineering, Engineering, Mathematics, Physics, or a related field from an accredited university, along with 2 years of experience; or a Master's degree in a related field; or 9 years of relevant work experience may be considered as an alternative to a degree * Applicants must have a current, active Government-Issued 8140 certification at IAT Level II or higher (such as Security+ CE, CCNA Security, CySA+**, GICSP, GSEC, SSCP, CASP+ CE, CISSP, etc.) at the time of application, which is required to start. The candidate is responsible for maintaining their 8140 certification throughout the entire contract period * Applicants must have a current, active in-scope Government-issued Secret security clearance at the time of application, which is required to start, with the ability to obtain Top Secret/SCI clearance * Demonstrated ability to identify known worms and viruses using signatures and behavioral indicators * Demonstrated ability to recognize network intrusion events and differentiate false positives from real incidents * Demonstrated ability to identify successful intrusions and compromises by reviewing and analyzing relevant event logs and other detailed technical information * Knowledge of and practical experience with a range of network and information security tools (e.g., intrusion detection systems, firewalls, log aggregation and correlation tools, vulnerability scanners) * Knowledge of modern computer systems and architectures, including client/server, LAN/WAN, and network concepts, as well as modern network management and monitoring * Knowledge of network hardware configuration and troubleshooting, including routers, CSU/DSU, bridges, multiplexers, servers, and switches * Previous experience monitoring and managing intrusion detection systems and firewall devices, including tools such as SideWinder, ArcSight, HBSS, and/or Tripwire * Experience securing network gear against known vulnerabilities through configuration hardening, patching, and application of security best practices Preferred Qualifications: * Applicants with a current, active in-scope Government-issued Top Secret/SCI security clearance at the time of application are highly desired * Certified Ethical Hacker (CEH) certification or equivalent offensive/penetration-testing credential * Formal training and/or hands-on experience with Unix and/or Microsoft operating systems (administration, security configuration, and troubleshooting) * Prior experience supporting missile defense, C2BMC, or similar DoD operational networks in a 24x7 environment ## Description The Command and Control, Battle Management, and Communications (C2BMC) program is a key component of the Missile Defense System. It is a vital operational system that enables the U.S. president, the Secretary of Defense, and combatant commanders at strategic, regional, and operational levels to plan ballistic missile defense operations systematically, collectively monitor the battle, and dynamically control networked sensors and weapon systems to achieve global and regional mission goals. C2BMC supports layered missile defense capabilities that enable an optimized response to threats across all ranges and flight phases. It serves as a force multiplier by networking, integrating, and synchronizing autonomous sensor and weapon systems and operations, both globally and regionally, to improve performance. C2BMC is essential for all ground and flight tests that verify and demonstrate the current and future capabilities of missile defense systems. The Regional Computer Network Defense Analyst (CNDA) is responsible for implementing and enforcing national, DoD (e.g., 8500.01, 6510), and MDA security directives and guidance to protect the C2BMC component of the Ballistic Missile Defense Communications Network (BMD COMNET) and the C2BMC mission systems and services. Essential Functions: * Performing continuous network security monitoring, intrusion detection, and incident response across BMD COMNET and C2BMC mission systems and services * Developing and maintaining a network defense visibility display and directing and executing time-sensitive adjustments to the network security posture to minimize or counter operational risk * Collecting, storing, correlating, and presenting network security data and metrics to senior leaders to support Operational Risk Management (ORM) decisions regarding network security posture * Performing proactive security functions to assist BMD organizations in deterring, detecting, isolating, containing, and recovering from information system (IS) and network security intrusions, and in mitigating known network vulnerabilities * Operating and administering BMD-provided computer network defense (CND) tools and capabilities (e.g., firewalls, correlated log analysis, intrusion alerts, host-based security tools) to protect BMD COMNET infrastructure and information services from internal and external cyber threats * Coordinating with other cybersecurity, network, and systems engineering teams to implement defensive measures, resolve security incidents, and enhance security architecture and monitoring capabilities * Documenting security events, incident response actions, and lessons learned, and contributing to process improvement and playbook refinement * Performing other related duties and assignments as required to support 24x7 C2BMC operations * This position requires rotating 24x7 shifts. The candidate will be assigned to a shift based on mission requirements. Some substitute shifts during off-shifts, including nights and weekends, will be required