DoD Cyber Threat Triage & Incident Analyst

MANTECH; Lorton (VA); On-site; USD 70,000 - 100,000; Full time

Job summary

MANTECH in Lorton, VA is seeking a Cybersecurity Triage Analyst to provide full-time support to a DoD customer. The role focuses on initial triage, analysis of threats, and escalation of incidents to protect critical infrastructure.

The ideal candidate holds a DoD IAT Level 2 certification, experience in security operations, and proficiency with querying languages and SIEM tools. Top-secret clearance with SCI eligibility is required.

Qualifications

• Bachelor’s degree with 2 years in security operations or substitute 2 years for degree.
• DoD 8570/8140 IAT Level 2 certification.
• Experience with querying languages (KQL/SQL/SPL).
• Experience protecting networks against external and insider threats.
• Experience with SCAP vulnerability scans.
• Familiar with CVE tracking and remediation.
• Fundamental understanding of cloud security (Azure/AWS/GCP).

Responsibilities

• Monitor, triage, and review incidents; escalate when needed.
• Ensure health of signal ingestion and alert processing.
• Daily security checks of tools to maintain health.
• Lead or participate in incident investigation, response, remediation, and documentation.
• Perform root-cause analysis and escalate complex issues.
• Support investigations of malicious actions, IOC remediation, insider threats.

Skills

Query languages (KQL, SQL, SPL)

Security operations

Incident response basics

Threat management

Education

Bachelor’s degree or equivalent experience

Tools

Splunk Enterprise

HBSS

ACAS

Microsoft Sentinel

SIEM

SOAR

XDR

Vulnerability management

Job description

MANTECH in Lorton, VA is seeking a Cybersecurity Triage Analyst to provide full-time support to a DoD customer. The role focuses on initial triage, analysis of threats, and escalation of incidents to protect critical infrastructure.

The ideal candidate holds a DoD IAT Level 2 certification, experience in security operations, and proficiency with querying languages and SIEM tools. Top-secret clearance with SCI eligibility is required.