Cyber Incident Response Specialist (Top Secret)

System One; Lincoln (MA); On-site; USD 96,000 - 165,000; Full time

Job summary

System One, Inc. seeks a Cyber Incident Response Specialist to investigate and respond to cybersecurity incidents, concentrating on containment, recovery, and readiness improvements.

This on-site role collaborates with security and IT teams to handle real-time incidents at Hanscom AFB, MA. The ideal candidate has hands-on incident response experience, familiarity with SIEM/EDR and network analysis, and strong documentation and communication skills.

Qualifications

• Active Top Secret security clearance.
• Hands-on experience in cybersecurity incident response or security operations.
• Experience with SIEM, endpoint detection and response, and network analysis tools.
• Working knowledge of Windows, Linux, networking, and common attacker techniques.
• Strong troubleshooting, documentation, and communication skills.

Responsibilities

• Investigate security alerts and suspected compromises across networks, endpoints, and systems.
• Analyze logs, network traffic, and endpoint evidence to determine incident scope and impact.
• Coordinate containment, eradication, and recovery activities.
• Preserve evidence and document investigation findings, timelines, and remediation actions.
• Communicate incident status and recommendations to technical teams and stakeholders.
• Help maintain response playbooks and conduct post-incident reviews.

Skills

Incident response

Security operations

SIEM

EDR

Network analysis

Troubleshooting

Documentation

Communication

Tools

SIEM

EDR

Network analysis tools

Job description

Cyber Incident Response Specialist

Hanscom AFB, MA

Top Secret Clearance required

We are seeking a Cyber Incident Response Specialist to investigate and respond to cybersecurity incidents. This hands‑on role will work with security and IT teams to contain threats, support recovery, and improve incident response readiness.

Responsibilities:

• Investigate security alerts and suspected compromises across networks, endpoints, and systems.
• Analyze logs, network traffic, and endpoint evidence to determine incident scope and impact.
• Coordinate containment, eradication, and recovery activities.
• Preserve evidence and document investigation findings, timelines, and remediation actions.
• Communicate incident status and recommendations to technical teams and stakeholders.
• Help maintain response playbooks and conduct post‑incident reviews.

Required qualifications:

• Active Top Secret security clearance.
• Hands‑on experience in cybersecurity incident response or security operations.
• Experience with SIEM, endpoint detection and response, and network analysis tools.
• Working knowledge of Windows, Linux, networking, and common attacker techniques.
• Strong troubleshooting, documentation, and communication skills.
• Ability to work onsite in the Boston, MA area for the 6‑month engagement.

Preferred qualifications

• Digital forensics or malware analysis experience.
• Familiarity with NIST incident response guidance and MITRE ATT&CK.
• Relevant certifications such as GCIH, GCFA, or comparable credentials.

#M1

#LI-VH1

Ref: #851-Rockville-S1