CSOC Tier 3 Incident Responder: Malware & Forensics

RISA; Springfield (VA); On-site; USD 87,000 - 95,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

401(k) and Roth

Paid Time Off

11 paid Federal Holidays

Job summary

RISA is seeking a highly skilled Incident Responder / Malware Analyst (CSOC Tier 3) to join the on-site team in Springfield, VA. You will lead containment, eradication, and recovery efforts for government-grade incidents, perform malware analysis and memory forensics, and develop indicators of compromise.

You will document findings and coordinate with CI, law enforcement, and internal stakeholders. The role requires active TS/SCI clearance, ability to obtain a polygraph, and a Bachelor’s degree

Qualifications

• Hands-on incident response: containment, eradication, and recovery.
• Host, network, and memory forensics, and malware analysis.
• Documentation disciplined enough that every action and analysis can be reconstructed from the ticket.
• DoD 8140.01 / 8570.01-M IAT Level II and CSSP Incident Responder; IAT Level III and CSSP Incident Responder must be held or obtained within six months of start.

Responsibilities

• Implement containment measures during incidents - IP and domain blocks, account disablement - at Government direction.
• Perform digital media analysis on host, server, and network data, including volatile and non-volatile memory.
• Perform malware analysis and reverse engineering, and develop signatures and indicators of compromise.
• Categorize incidents, build timelines, and brief stakeholders on adversary activity and response actions.
• Coordinate with counterintelligence, insider threat, and law enforcement partners on advanced investigation and triage.
• Develop and, when authorized, run custom scripts and tools to collect and analyze data.
• Write incident investigation reports covering the full lifecycle of each incident, with corrective and TTP recommendations.
• Contribute to daily and weekly CSOC reporting, and quality-check a share of closed Tier 2 tickets each week.

Skills

Incident response

Malware analysis

Forensics

Threat intelligence coordination

Documentation discipline

Education

Bachelor's degree plus 6 years of relevant experience

Job description

RISA is seeking a highly skilled Incident Responder / Malware Analyst (CSOC Tier 3) to join the on-site team in Springfield, VA. You will lead containment, eradication, and recovery efforts for government-grade incidents, perform malware analysis and memory forensics, and develop indicators of compromise.

You will document findings and coordinate with CI, law enforcement, and internal stakeholders. The role requires active TS/SCI clearance, ability to obtain a polygraph, and a Bachelor’s degree