Senior Incident Response Analyst – Tier 3, IR Lead
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Senior Incident Response Analyst leading APT, FIN, cloud, and Tier 3 investigations for a federal financial regulatory agency. Mentoring analysts and delivering defensible cybersecurity reports.
Responsibilities:
- Triage, investigate, contain, and remediate cybersecurity incidents through resolution
- Lead incidents end to end as the most senior analyst on the team
- Review junior analysts' work and provide feedback for growth
- Respond to APT and FIN threat actors and cloud-based AWS threats from detection through eradication and lessons learned
- Investigate in Splunk SIEM and Microsoft Defender EDR
- Build and tune Splunk SOAR playbooks
- Pull AWS telemetry and map activity to MITRE ATT&CK
- Follow NIST 800-61 incident handling practices
- Recommend and implement process improvements with government staff
- Support auditors during reviews of IR processes
- Participate in a weekly after-hours on-call rotation, approximately one week in six
- Author incident reports in Archer
- Track investigations and documentation in GitHub
- Perform QA on team member submissions before client delivery
- Work directly with government staff and clients as part of a federal financial regulatory agency's cybersecurity operations
Requirements:
- 5+ years of hands-on incident response experience
- Experience handling and responding to an APT or FIN actor
- Experience responding to cloud-based threats in an IR capacity, including AWS or Azure/M365
- Experience working directly with clients in a professional demeanor
- Experience with Microsoft Defender EDR (preferred) or an equivalent enterprise EDR such as CrowdStrike or SentinelOne
- Knowledge of SOC best practices
- Ability to work with government staff to suggest and implement process improvements
- Ability to work with auditors to respond to and resolve identified issues in IR processes
- Ability to author clear and robust reports and review and ensure QA of team member submissions
- Senior-level Incident Response certification: GIAC GCIH, GCFA, GCFR, GNFA, GREM, or EC-Council ECIH
- Ability to participate in a weekly after-hours on-call rotation
- Bachelor's Degree required
- Public Trust / Suitability clearance; applicants selected will be subject to a security investigation
- Must be a U.S. Citizen
- Ability to work within core hours of approximately 7:30 AM–4:30 PM US Eastern Time, Monday through Friday
- Experience with Splunk (SIEM) and Splunk SOAR, including playbook development
- Experience with GitHub for investigation tracking and documentation
- Experience with Archer (RSA/Archer GRC) as an incident system of record
- Experience responding to incidents in AWS, including CloudTrail, GuardDuty, and IAM/credential abuse
- Experience mapping activity to MITRE ATT&CK and following NIST 800-61
- Scripting for automation and triage using Python and SPL
- Threat hunting experience
- Ability to review work from junior analysts and provide feedback for growth
Benefits:
- Medical Insurance
- Dental Insurance
- Vision Insurance
- Life Insurance
- Short Term & Long Term Disability
- 401k Retirement Savings Plan with Company Match
- Paid Holidays
- Paid Time Off (PTO)
- Tuition and Professional Development Assistance
Similar Jobs
Incident Response Analyst
Incident Response Analyst containing cybersecurity incidents for Cynet, an AI-powered threat detection and response company. Performing forensics, malware analysis, and threat hunting to improve customer protection.
Incident Response Analyst
Incident Response Analyst containing incidents, performing digital forensics, and analyzing malware for Cynet's threat detection and response platform. Supporting customer protection and continuous security improvement.
Incident Response Analyst
Incident Response Analyst containing, investigating, and remediating cybersecurity incidents for Cynet customers. Improving its AI-powered threat detection and response capabilities through forensics and threat intelligence.
Senior Cyber Incident Response Attorney
Senior attorney leading cybersecurity incident response, privacy litigation, and breach compliance matters. Advising clients and supervising teams at national law firm Wilson Elser.
Senior Cyber Incident Response Attorney
Senior attorney leading cybersecurity incident response, breach notifications, privacy litigation, and regulatory matters. Wilson Elser is a national law firm serving clients across 46 offices.
Senior Cyber Incident Response Attorney
Senior attorney leading cybersecurity incident response, breach notifications, and privacy litigation. Wilson Elser is a national law firm serving clients across complex legal matters.
Senior Cyber Incident Response Attorney
Senior attorney handling cybersecurity incidents, privacy compliance, and litigation for national law firm Wilson Elser. Advising clients, regulators, carriers, and legal teams on data breaches.
Senior Cyber Incident Response Attorney
Senior attorney handling cybersecurity incident response, privacy litigation, and breach counseling. Wilson Elser is a national law firm serving clients across the United States.
Incident Response Analyst
Incident Response Analyst leading forensic investigations and containment for Sophos’s managed detection and response customers. Collaborating with security teams to improve threat detection and incident reporting.
Incident Response Analyst, Overnight Shift
Incident response analyst protecting the Federal Reserve’s economic, financial, and payments systems. Triaging security events, conducting network forensics, and responding to cyberattacks overnight.
Analyst
Palantir Analyst role supporting delivery within Palantir-based programmes. Bridging business needs and technical implementation in complex enterprise environments.
No more related jobs available.