Remote Incident Response Analyst

We are looking for someone to Respond to cybersecurity incidents and proactively prevent the reoccurrence of these incidents. Apply specific functional knowledge to resolve cybersecurity incidents. Analyze or contribute to solutions to a variety of problems of moderate scope and complexity.

The 5 things I care about most: 1. Real Incident Response experience -They have actually responded to hacks/security breaches, not just monitored alerts. 2. APT or FIN actor experience -Basically, they have dealt with serious hackers, either sophisticated organized/nation-state groups or hackers trying to make money. 3. Cloud attacks -They have investigated attacks involving environments like Microsoft Azure or AWS, not only laptops and traditional networks. 4. Microsoft Defender -They’ve actually used Microsoft Defender EDR / Defender for Endpoint to investigate suspicious activity. 5. Senior communication skills -They can investigate the attack AND confidently explain what happened to the Booz/government client, write up a strong report, and review junior analysts’ work., 5+ years of experience with incident response -Experience with handling and responding to an APT or FIN actor and responding to cloud-based threats in an IR capacity -Experience with working directly with clients in a professional demeanor -Experience with Microsoft Defender EDR -Knowledge of SOC best practices -Ability to work with government staff to suggest and implement process improvements and work with auditors to respond to and resolve identified issues in the IR processes -Ability to author clear and robust reports and review and ensure QA of team member submissions -Ability to obtain and maintain a Public Trust or Suitability/Fitness determination based on client requirements -Bachelor’s degree -Senior level Incident Response Certification -Experience with Splunk -Experience with GitHub -Experience with Archer -Ability to review work from junior analysts and provide feedback for growth