Cybersecurity Incident and Application Analyst

Gunnison Consulting Group; Bethesda (MD); Hybrid; USD 130,000 - 145,000; Full time

Benefits offered by this job

3 weeks Personal Leave your first year

11 paid Holidays each year

Flexible Time Off for training/certs

401(k) company match

Medical, Dental and Vision Insurance

Life and Disability Insurance

Public Transportation Subsidies

Certifications and Training Allowance

Job summary

Gunnison Consulting Group in Bethesda, MD is seeking an experienced cybersecurity incident responder to support detection, analysis, containment, recovery, and post-incident activities across NIH CIT environments. The role is hybrid, requiring 2–5 years of related experience and active certifications.

The position involves monitoring security events with Splunk, analyzing network traffic and logs, applying the NIST incident-handling framework, and coordinating with system owners, engineers, and

Qualifications

• Two to five years of cybersecurity incident response or related discipline.
• Experience in SIEM analysis, Splunk, and incident documentation.
• Knowledge of NIST SP 800-61 and incident playbooks.
• Bachelor’s degree in cybersecurity or related field; active certifications listed.

Responsibilities

• Support cybersecurity incident detection, analysis, response, containment, recovery, and post-incident activities.
• Monitor, investigate, validate, and triage security events, alerts, suspicious activity, and potential indicators of compromise; assign appropriate severity and criticality based on operational impact, threat context, and established escalation procedures.
• Apply the enterprise incident-response lifecycle: preparation; detection and analysis; containment, eradication, and recovery; and post-incident analysis.
• Analyze network traffic, system logs, endpoint telemetry, application activity, authentication events, and security-tool alerts to identify malicious, anomalous, or unauthorized activity.
• Evaluate network, web application, cloud, and endpoint environments for insecure configurations, vulnerable ports, unnecessary services, weak protocols, default credentials, insecure communication methods, and other security weaknesses.
• Perform cybersecurity incident analysis using tools and platforms such as FireEye or comparable endpoint/threat-detection technologies, Palo Alto IDS/IPS and firewall technologies, Splunk SIEM, Tenable vulnerability-management tools, and related security operations tools.
• Support investigation of web application and cloud security events, including suspicious access, misconfigurations, exposed services, anomalous traffic, unauthorized changes, and potential data-security risks.
• Maintain a working knowledge of common ports, protocols, network services, attack vectors, and security-control configurations relevant to incident investigation and response.
• Conduct or support incident containment and recovery activities in coordination with system owners, network engineers, cybersecurity engineers, application teams, and Government stakeholders.
• Create, update, and follow incident response playbooks, standard operating procedures, RACI charts, escalation matrices, and communication plans.
• Document incident timelines, investigative steps, evidence, findings, impact analysis, containment actions, recovery actions, and recommended corrective measures.
• Lead or support post-incident reviews and lessons-learned activities; assess the effectiveness of the Incident Response Plan (IRP), playbooks, and procedures, and recommend improvements.
• Assist with annual incident-response exercises, tabletop exercises, and technical tests; document test results, gaps, corrective actions, and updates to incident-response documentation.
• Produce accurate, timely incident reports, status updates, dashboards, executive summaries, and management briefings appropriate for technical and nontechnical stakeholders.
• Maintain familiarity with NIST SP 800-61 incident-handling guidance and apply it to daily incident-response operations.

Skills

Incident response

Threat detection

Security monitoring

Collaboration with govt stakeholders

Documentation & reporting

Education

Bachelor’s degree in cybersecurity or related field

Tools

Splunk

Palo Alto

FireEye

Tenable

Windows & Linux

Job description

Description

* This position is contingent upon a future opening with Gunnison.

Salary: $130,000 - $145,000/year

Work location: Hybrid, 2-3 days per week on-site in Bethesda, MD.

• Support cybersecurity incident detection, analysis, response, containment, recovery, and post-incident activities across NIH CIT enterprise network, web application, endpoint, server, and cloud environments.
• Monitor, investigate, validate, and triage security events, alerts, suspicious activity, and potential indicators of compromise; assign appropriate severity and criticality based on operational impact, threat context, and established escalation procedures.
• Apply the enterprise incident-response lifecycle: preparation; detection and analysis; containment, eradication, and recovery; and post-incident analysis.
• Analyze network traffic, system logs, endpoint telemetry, application activity, authentication events, and security-tool alerts to identify malicious, anomalous, or unauthorized activity.
• Evaluate network, web application, cloud, and endpoint environments for insecure configurations, vulnerable ports, unnecessary services, weak protocols, default credentials, insecure communication methods, and other security weaknesses.
• Perform cybersecurity incident analysis using tools and platforms such as FireEye or comparable endpoint/threat-detection technologies, Palo Alto IDS/IPS and firewall technologies, Splunk SIEM, Tenable vulnerability-management tools, and related security operations tools.
• Support investigation of web application and cloud security events, including suspicious access, misconfigurations, exposed services, anomalous traffic, unauthorized changes, and potential data-security risks.
• Maintain a working knowledge of common ports, protocols, network services, attack vectors, and security-control configurations relevant to incident investigation and response.
• Conduct or support incident containment and recovery activities in coordination with system owners, network engineers, cybersecurity engineers, application teams, and Government stakeholders.
• Create, update, and follow incident response playbooks, standard operating procedures, RACI charts, escalation matrices, and communication plans.
• Document incident timelines, investigative steps, evidence, findings, impact analysis, containment actions, recovery actions, and recommended corrective measures.
• Lead or support post-incident reviews and lessons-learned activities; assess the effectiveness of the Incident Response Plan (IRP), playbooks, and procedures, and recommend improvements.
• Assist with annual incident-response exercises, tabletop exercises, and technical tests; document test results, gaps, corrective actions, and updates to incident-response documentation.
• Produce accurate, timely incident reports, status updates, dashboards, executive summaries, and management briefings appropriate for technical and nontechnical stakeholders.
• Maintain familiarity with NIST SP 800-61 incident-handling guidance and apply it to daily incident-response operations.

Requirements

Minimum of two (2) to five (5) years of progressively responsible experience in cybersecurity incident response, security operations, network security, application security, cloud security, threat detection, or a related discipline.

Candidates should demonstrate experience in:

• Security-event monitoring, alert triage, incident investigation, incident documentation, escalation, and response coordination.
• Enterprise incident-response processes, including preparation, detection and analysis, containment, eradication, recovery, and post-incident activities.
• Network security, web application security, cloud technologies, endpoint security, and security monitoring.
• Identifying vulnerable services, insecure ports and protocols, default or weak configurations, and common network/application security weaknesses.
• SIEM analysis, preferably Splunk, including log searches, dashboards, correlation, alert analysis, and report generation.
• IDS/IPS, firewalls, endpoint detection and response, vulnerability-management, and threat-detection technologies, including Palo Alto, FireEye or comparable platforms, and Tenable.
• Windows and Linux operating systems, including basic system/log analysis and security troubleshooting.
• NIST SP 800-61 and the creation or use of incident-response playbooks, RACI charts, escalation procedures, SOPs, and lessons-learned documentation.
• Preparing technical findings, incident reports, management updates, and executive-level summaries.
• Bachelor’s degree from an accredited college or university in cybersecurity, information assurance, computer science, information systems, computer engineering, network engineering, digital forensics, systems engineering, or a closely related technical discipline.
• EC-Council Certified Incident Handler (E|CIH), current and active
• Offensive Security Certified Professional (OSCP), current and active
• GIAC Certified Incident Handler (GCIH), current and active
• Current Splunk certification, such as Splunk Core Certified Power User, Splunk Enterprise Certified Admin, Splunk Core Certified Advanced Power User, or an equivalent Splunk security/engineering credential

Clearance Requirement: Ability to obtain and maintain a Public Trust.

Desired Qualifications

• Master’s degree in cybersecurity, information assurance, computer science, digital forensics, information systems, engineering, data analytics, or a related technical discipline.
• GIAC Certified Intrusion Analyst (GCIA)
• GIAC Security Essentials (GSEC)
• GIAC Certified Forensic Analyst (GCFA)
• GIAC Reverse Engineering Malware (GREM)
• GIAC Penetration Tester (GPEN)
• CompTIA Security+, CySA+, PenTest+, or CASP+
• Certified Ethical Hacker (CEH)
• Certified Information Systems Security Professional (CISSP)
• Palo Alto Networks Certified Network Security Engineer (PCNSE) or related Palo Alto credential
• Tenable/Nessus platform training or certification
• FireEye, Trellix, Microsoft Defender, CrowdStrike, SentinelOne, or comparable EDR/XDR training
• AWS Certified Security - Specialty
• Microsoft Certified: Azure Security Engineer Associate
• Google Professional Cloud Security Engineer
• Cisco CyberOps Associate/Professional, CCNP Security, or equivalent network-security certification
• ITIL Foundation, particularly for candidates supporting formal incident, problem, and change-management processes

The salary range for this position depends upon multiple factors including location, the individual's knowledge, skills, competencies, and experience, and contract-specific budget constraints and organizational requirements.
Gunnison Consulting Group's total compensation package also includes bonus and profit-sharing opportunities, depending on company and employee performance. Available employee benefits include:

• 3 weeks of Personal Leave your first year
• 11 paid Holidays each year
• 5 days of Flexible Time Off each year for approved training or certifications (self-study is ineligible)
• 401(k) company match at 50% up to 10% of your salary
• Medical, Dental and Vision Insurance
• Life and Disability Insurance
• Public Transportation Subsidies
• Certifications and Training Allowance - Up to $5,000/year!

Why Join Gunnison?

• Gunnison takes on ambitious projects. We target fun, challenging work that requires creative thinking and innovation.
• Quality is our top priority.
• Gunnison employee benefits meet or exceed what other companies in the Washington, D.C. metropolitan area offer.
• There is a great sense of camaraderie at Gunnison. This is an atmosphere we will maintain as we continue to grow.
• We are growing rapidly and the opportunity for individual professional growth with Gunnison is outstanding.
• We hire for careers at Gunnison, not to fill a position.

Equal Opportunity/Affirmative Action Employer. Must be eligible for employment in the United States. We are unable to sponsor candidates at this time.
In 1994 Gunnison began serving the greater Washington, D.C. metro area, focused on tackling our customers' most ambitious technology projects. By creating a culture dedicated to enabling our customers and employees to achieve more than they ever thought they could, the company has thrived for over 25 years.