DoD Incident Response Analyst | Secret Clearance Required

Koitecc Solutions; Alexandria (VA); On-site; USD 87,000 - 157,000; Full time

Job summary

Leidos is seeking an experienced Incident Response Analyst to support the DMDC CyberPRIMES program. The role focuses on investigating and responding to cybersecurity events across NIPRNet and SIPRNet, guiding containment, eradication, and recovery efforts, and coordinating with SOC analysts and system owners.

Responsibilities include proactive monitoring, evidence collection, maintaining incident records, and contributing to post-incident lessons learned; after-hours recall may be required.

Qualifications

• Bachelor’s degree and 5+ years of cybersecurity experience; degree may be substituted with equivalent experience.
• Experience supporting cybersecurity incident response and SOC operations.
• Experience analyzing cybersecurity events and determining appropriate response actions.
• Experience documenting incident timelines, evidence, and status.

Responsibilities

• Support incident lifecycle activities: detection, containment, eradication, recovery, and post-incident actions.
• Investigate incidents affecting NIPRNet and SIPRNet environments.
• Perform proactive security monitoring and analysis for intrusions and malicious activity.
• Analyze security data from SIEM, endpoint-security, firewalls, IDS/IPS and related tools.
• Recognize and escalate potential intrusion activity requiring investigation.
• Coordinate containment and mitigation with system owners and cybersecurity teams.
• Collect and preserve technical evidence and maintain incident records.

Skills

Incident response

Security Operations

Investigation

Documentation

Evidence collection

Communication during incidents

After-hours recall

Rapid mitigation

Education

Bachelor’s degree

Tools

SIEM tooling

Endpoint security

IDS/IPS

Firewalls

Job description

Leidos is seeking an experienced Incident Response Analyst to support the DMDC CyberPRIMES program. The role focuses on investigating and responding to cybersecurity events across NIPRNet and SIPRNet, guiding containment, eradication, and recovery efforts, and coordinating with SOC analysts and system owners.

Responsibilities include proactive monitoring, evidence collection, maintaining incident records, and contributing to post-incident lessons learned; after-hours recall may be required.