Cybersecurity Incident Response & Threat Detection Analyst (Ohio)

Markesman Group; Whitehall (OH); On-site; USD 120,000 - 170,000; Full time

Job summary

First Roles in Cincinnati, OH is seeking a seasoned cybersecurity professional to monitor SIEM, analyze events, and coordinate incident response across defenses. You will apply Defense-in-Depth and threat intelligence to detect and contain threats in a high-security environment.

The role requires 5+ years in cybersecurity, experience with root-cause analysis, scripting in Python/PowerShell, SPL, and eligibility for DoD Top Secret clearance and SCI access.

Qualifications

• 5+ years of relevant cybersecurity experience.
• 2+ years performing root-cause analysis of cybersecurity events and incidents.
• Knowledge of multiple security technologies (firewalls, IDS/IPS, endpoint protection, etc.).
• Understanding of Defense-in-Depth.
• Ability to develop scripts/tools for detection and response.
• Experience with SPL, Python and/or PowerShell preferred.
• DoD Top Secret clearance and SCI access eligibility.
• Eligible for IT-I Critical Sensitive / Tier 5 at proposal submission.

Responsibilities

• Monitor SIEM and cybersecurity platforms to identify and respond to threats.
• Analyze logged events and network traffic for indications of attack or compromise.
• Investigate advanced threats and adversary activity.
• Perform incident detection, analysis, containment, and response.
• Conduct root-cause analysis of cybersecurity events and incidents.
• Analyze security alerts across multiple defensive technologies.
• Support enterprise cybersecurity tools and applications.
• Apply Defense-in-Depth to improve enterprise security posture.
• Use threat intelligence and OSINT to improve detection and response.
• Develop scripts/tools to enhance threat detection and incident response.
• Coordinate incident findings with cybersecurity stakeholders.

Skills

Cybersecurity experience

Root-cause analysis

Defense-in-Depth

Scripting

Python/PowerShell

SPL

Threat intelligence

SCI access eligibility

DoD Top Secret clearance

IT-I Tier 5 eligibility

Job description

Responsibilities

• Monitor SIEM and other cybersecurity platforms to identify and respond to cyber threats
• Analyze logged events and network traffic for indications of attack or compromise
• Investigate Advanced Persistent Threats and low-and-slow adversary activity
• Perform cybersecurity incident detection, analysis, containment, and response
• Conduct root-cause analysis of cybersecurity events and incidents
• Analyze security alerts across multiple defensive security technologies
• Support enterprise cybersecurity tools and applications
• Apply Defense-in-Depth principles to improve enterprise security posture
• Use threat intelligence and OSINT to improve detection and response capabilities
• Develop scripts and tools to improve threat detection and incident response
• Support implementation and sustainment of defensive signatures and perimeter security controls
• Coordinate incident findings and response actions with cybersecurity stakeholders

Qualifications

• 5+ years of relevant cybersecurity experience
• 2+ years performing root-cause analysis of cybersecurity events and incidents
• Working knowledge of at least two security technology areas such as firewalls, IDS/IPS, endpoint protection, DLP, vulnerability management, forensics, malware analysis, or device hardening
• Understanding of Defense-in-Depth
• Ability to develop scripts and tools supporting detection and incident response
• Experience with SPL, Python, and/or PowerShell preferred
• DoD Top Secret clearance
• Eligible for SCI access
• Eligible for IT-I Critical Sensitive / Tier 5 (T5) at proposal submission