Cyber Incident Responder

Description

Looking for an opportunity to make an impact?

At Leidos, we deliver innovative solutions through the efforts of our diverse and talented people who are dedicated to our customers’ success. We empower our teams, contribute to our communities, and operate sustainably. Everything we do is built on a commitment to do the right thing for our customers, our people, and our community. The Leidos National Security Sector (NSS) combines technology-enabled services and mission software capabilities in the areas of cyber, logistics, security operations, and decision analytics to support our defense and intel customers’ mission to defend against evolving threats around the world.

Your greatest work is ahead!

The Multi-domain Solutions Division (MDS) within the Leidos National Security Sector is seeking a skilled Incident Responder to join a new cyber security program and play a key role in supporting government-critical systems. You will be part of a program that oversees development, integration, delivery, and operations and maintenance of IT managed security services, which encompasses support to monitor the cybersecurity threat and security posture situational awareness for the enterprise. This opportunity is in anticipation of a future contract award!

What you’ll be doing:

• Validate escalated cyber events to determine potential and/or actual impact to the organization.
• Work closely with multiple stakeholder groups to prioritize incidents and coordinate the overall response effort to contain and eradicate threats and support remediation efforts to restore assets and capabilities to normal operations.
• Apply strong analytical skills, technical expertise in multiple domains (endpoints, network, cloud), and a proactive approach to safeguarding critical systems and sensitive data.

What does Leidos need from me?

• Active Top Secret/SCI (TS/SCI) with Polygraph security clearance required. Must be U.S. Citizen.
• Bachelor's and 8 to 12 years of prior relevant experience. Experience may be considered in lieu of degree.

Favorable if you have:

• Industry certification(s) such as: SANS GIAC Certification (e.g., GCIH, GCFA, GNFA), CySA+, AWS (Associate level, Security specialty), Azure (AZ-500, AZ-104, DP-203), RHCSA.
• Possess excellent verbal and written communications skills and ability to produce clear and thorough security incident reports and briefings to technical and non-technical audiences.
• Experience with scripting or automation tools (e.g., Python, PowerShell, SOAR).
• Have developed or contributed to Standard Operating Procedures (SOPs) and/or Playbooks.
• Proficiency with cybersecurity tools (e.g., SIEM, EDR/XDR).
• Ability to tune or author threat detection alerts and signatures.