Cyber Threat Triage Analyst – Incident Response

Nightwing; Arlington, Northern (VA, KY); Hybrid; USD 77,000 - 163,000; Full time

Benefits offered by this job

Medical insurance

Vision insurance

Dental insurance

401k plan

PTO

Job summary

Nightwing is seeking an IR Specialist in Arlington, VA to support a U.S. Government customer with cyber incident response and threat triage. You will analyze IOC data, enrich indicators with threat intel, and coordinate with interagency partners to ensure rapid escalation and effective response across critical infrastructure sectors.

The role requires active TS/SCI eligibility, U.S. citizenship, and the ability to obtain DHS suitability, with 3–5 years in threat intelligence or SOC operations.

Qualifications

• 3–5 years of progressive experience in threat intelligence, SOC operations, or cyber incident response.
• Active Top Secret with SCI Eligibility and ability to obtain DHS suitability.

Responsibilities

• Perform initial triage and assessment of incoming cyber threat tickets, incident reports, and IOC submissions.
• Analyze technical data including IP addresses, domain names, file hashes, network traffic patterns, and malware artifacts.
• Determine threat severity, credibility, and potential impact to critical infrastructure sectors.
• Enrich IOCs using threat intelligence platforms, OSINT, and government-exclusive resources.
• Prepare concise triage reports with actionable recommendations for escalation or further analysis.
• Route tickets to appropriate teams and coordinate with interagency partners.

Skills

Threat intelligence

SOC operations

Cyber incident response

Incident triage

Analytical reasoning

Education

Top Secret/SCI clearance

Security+ / CySA+ / GCIH / GCIA

DHS Suitability

Tools

SIEM platforms

Threat intelligence platforms

OSINT resources

Ticketing systems

Job description

Nightwing is seeking an IR Specialist in Arlington, VA to support a U.S. Government customer with cyber incident response and threat triage. You will analyze IOC data, enrich indicators with threat intel, and coordinate with interagency partners to ensure rapid escalation and effective response across critical infrastructure sectors.

The role requires active TS/SCI eligibility, U.S. citizenship, and the ability to obtain DHS suitability, with 3–5 years in threat intelligence or SOC operations.