Incident Response Analyst

Leidos Inc; Alexandria (VA); On-site; USD 87,000 - 157,000; Full time

Job summary

Leidos is seeking experienced Incident Response Analysts to support the DMDC CyberPRIMES program. The role focuses on investigating and responding to cybersecurity events affecting DHRA systems, collaborating with SOC analysts, CSSPs, system owners, and technical teams during active incidents.

You will perform detection, analysis, containment, eradication, recovery, and post-incident activities and maintain complete incident records. U.S. Citizenship and an Active Secret clearance are required.

Qualifications

• Bachelor's degree and 4+ years of cybersecurity experience.
• Experience supporting cybersecurity incident response, SOC operations, cyber defense, or security-event investigation.
• Experience performing analysis of cybersecurity events and determining appropriate response or escalation actions.
• Experience supporting containment, eradication, recovery, and post-incident activities.
• Experience monitoring and analyzing enterprise cybersecurity tools and telemetry.
• Experience documenting incident timelines, evidence, response actions, and status.
• Experience coordinating cybersecurity incidents across technical teams and stakeholders.
• U.S. Citizenship required, Active Secret security clearance required.

Responsibilities

• Support preparation, detection, analysis, containment, eradication, recovery, and post-incident activities for cybersecurity events and incidents.
• Investigate cybersecurity incidents affecting NIPRNet and SIPRNet environments.
• Perform proactive security monitoring and analysis to identify intrusion attempts and other malicious activity.
• Analyze security information from SIEM, EDR, firewalls, IDS/IPS, web-security, and malware-prevention systems.
• Coordinate eradication and recovery activities with system owners, administrators, and cybersecurity teams.
• Collect and preserve technical evidence and maintain incident records, timelines, and findings.
• Develop cybersecurity event and incident reporting and provide status updates during investigations.
• Participate in after-hours incident response and recall as required.

Skills

Incident response

Security operations

Threat analysis

Documentation

Communication

After-hours recall

Security clearance

Education

Bachelor's degree

Tools

SIEM

EDR

Firewall

IDS/IPS

Endpoint protection

Web security

Job description

Description

Looking for an opportunity to make an impact?

At Leidos, we deliver innovative solutions through the efforts of our diverse and talented people who are dedicated to our customers' success. We empower our teams, contribute to our communities, and operate sustainable. Everything we do is built on a commitment to do the right thing for our customers, our people, and our community. Our Mission, Vision, and Values guide the way we do business.

If this sounds like a mission you want to be a part of, keep reading!

Leidos is seeking experienced Incident Response Analysts to support the Defense Manpower Data Center (DMDC) CyberPRIMES program. Leidos is a major partner on the contract and will provide a substantial portion of the cybersecurity workforce supporting the Defense Human Resources Activity (DHRA) and DMDC. The Incident Response Analyst will investigate and respond to cybersecurity events and incidents affecting DHRA systems and networks. This position supports the full incident-response lifecycle-from detection and analysis through containment, eradication, recovery, and post-incident activities-and works closely with Security Operations Center analysts, Cybersecurity Service Providers, system owners, and technical teams during active cybersecurity incidents.

Work Locations:

Mark Center, Alexandria, Virginia - 2 positions

Department of Defense Center - Monterey Bay, Seaside, California - 1 position

Mission Environment

DMDC supports the Defense Human Resources Activity within the Office of the Under Secretary of Defense for Personnel and Readiness (OUSD(P&R)) and maintains the Department of Defense's largest and most comprehensive central repository of personnel, manpower, casualty, pay, entitlement, personnel security, identity, readiness, training, and related data.

The DHRA Information Technology (IT) environment includes approximately 15,000 network and endpoint devices supporting more than 600 Government-Off-The-Shelf (GOTS) applications and approximately 100 Risk Management Framework (RMF) authorization boundaries managed through the Enterprise Mission Assurance Support Service (eMASS). Incident-response operations support both the Non-classified Internet Protocol Router Network (NIPRNet) and Secret Internet Protocol Router Network (SIPRNet) environments. Analysts must be able to move quickly from security-event identification into investigation and coordinated response while maintaining accurate records, preserving evidence, and keeping Government stakeholders informed.

Primary Tasks

• Support preparation, detection, analysis, containment, eradication, recovery, and post-incident activities for cybersecurity events and incidents.
• Investigate cybersecurity incidents affecting NIPRNet and SIPRNet environments.
• Perform proactive security monitoring and analysis to identify potential intrusion attempts and other malicious activity.
• Analyze security information from Security Information and Event Management (SIEM) platforms, endpoint-security capabilities, firewalls, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), web-security systems, antispam capabilities, malware-prevention systems, and related enforcement technologies.
• Recognize potential intrusion attempts, malicious activity, or other cybersecurity conditions requiring immediate investigation or mitigation.
• Assess cybersecurity events to determine scope, potential impact, affected systems, and required response actions.
• Support containment and mitigation of active cybersecurity threats in accordance with approved Government procedures.
• Coordinate eradication and recovery activities with system owners, administrators, network personnel, cybersecurity teams, and other technical stakeholders.
• Collect and preserve technical evidence associated with cybersecurity events and incidents.
• Maintain complete and accurate incident records, timelines, supporting evidence, investigative findings, response actions, and status information.
• Develop and contribute to required cybersecurity event and incident reporting.
• Coordinate incident-response activities with Security Operations Center analysts, Cybersecurity Service Providers (CSSPs), system owners, technical teams, and Government stakeholders.
• Support escalation of significant cybersecurity events and incidents in accordance with established procedures.
• Provide timely status updates during active investigations and incident-response activities.
• Support post-incident analysis and lessons learned to identify opportunities to improve monitoring, detection, response procedures, and defensive capabilities.
• Participate in after-hours incident response when assigned and meet the contract-required one-hour recall requirement.

Basic Qualifications

• Bachelor's degree and 4 or more years of relevant cybersecurity experience.
• Experience supporting cybersecurity incident response, Security Operations Center operations, cyber defense, or security-event investigation.
• Experience performing analysis of cybersecurity events and determining appropriate response or escalation actions.
• Experience supporting incident containment, eradication, recovery, and post-incident activities.
• Experience monitoring and analyzing enterprise cybersecurity tools and security telemetry.
• Experience documenting incident timelines, investigative findings, evidence, response actions, and status.
• Experience coordinating cybersecurity incidents across technical teams and stakeholder organizations.
• Working knowledge of network, endpoint, and enterprise cybersecurity monitoring concepts.
• Ability to recognize potential intrusion activity and support rapid mitigation of cybersecurity threats.
• Ability to communicate clearly during active cybersecurity incidents and maintain accurate documentation under time-sensitive conditions.
• Ability to support after-hours incident response and the required one-hour recall when assigned.
• U.S. Citizenship required.
• Active Secret security clearance required.

Preferred Qualifications

• Experience supporting cybersecurity incident response within Department of Defense or Federal environments.
• Experience responding to incidents in both unclassified and classified network environments.
• Experience with Security Information and Event Management platforms and enterprise security-monitoring capabilities.
• Experience analyzing endpoint-security, firewall, Intrusion Detection System, Intrusion Prevention System, web-security, antispam, or malware-prevention data.
• Experience supporting evidence collection and preservation during cybersecurity investigations.
• Experience coordinating incident response with Security Operations Center personnel, Cybersecurity Service Providers, system owners, network teams, and other technical organizations.
• Experience operating in a 24x7 cybersecurity operations environment or supporting after-hours incident response.
• Familiarity with Department of Defense cybersecurity incident-response processes and requirements.
• Familiarity with DHRA, DMDC, or comparable Department of Defense enterprise environments.

If you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo - because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 - and moving faster than anyone else dares.

Original Posting:October 9, 2026

For U.S. Positions: While subject to change based on business needs, Leidos reasonably anticipates that this job requisition will remain open for at least 3 days with an anticipated close date of no earlier than 3 days after the original posting date as listed above.

Pay Range:Pay Range $87,100.00 - $157,450.00

About Leidos

Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations. Headquartered in Reston, Virginia, with 47,000 global employees, Leidos reported annual revenues of approximately $16.7 billion for the fiscal year ended January 3, 2025. For more information, visit www.Leidos.com.

Pay and Benefits

Pay and benefits are fundamental to any career decision. That's why we craft compensation packages that reflect the importance of the work we do for our customers. Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement. More details are available at www.leidos.com/careers/pay-benefits.

Securing Your Data

Beware of fake employment opportunities using Leidos' name. Leidos will never ask you to provide payment-related information during any part of the employment application process (i.e., ask you for money), nor will Leidos ever advance money as part of the hiring process (i.e., send you a check or money order before doing any work). Further, Leidos will only communicate with you through emails that are generated by the Leidos.com automated system - never from free commercial services (e.g., Gmail, Yahoo, Hotmail) or via WhatsApp, Telegram, etc. If you received an email purporting to be from Leidos that asks for payment-related information or any other personal information (e.g., about you or your previous employer), and you are concerned about its legitimacy, please make us aware immediately by emailing us at [e-mail].

If you believe you are the victim of a scam, contact your local law enforcement and report the incident to the U.S. Federal Trade Commission.

Commitment to Non-Discrimination

All qualified applicants will receive consideration for employment without regard to sex, race, ethnicity, age, national origin, citizenship, religion, physical or mental disability, medical condition, genetic information, pregnancy, family structure, marital status, ancestry, domestic partner status, sexual orientation, gender identity or expression, veteran or military status, or any other basis prohibited by law. Leidos will also consider for employment qualified applicants with criminal histories consistent with relevant laws.

#Remote