Incident Response Analyst

Leidos; Seaside (OR); On-site; USD 87,000 - 157,000; Full time

Job summary

Leidos is seeking an experienced Incident Response Analyst to support the DMDC CyberPRIMES program, investigating and responding to cybersecurity events affecting DHRA and DMDC systems. You will manage the full incident-response lifecycle from detection to post-incident activities and coordinate with SOC analysts and government stakeholders.

Responsibilities include analyzing SIEM, endpoint-security, firewalls, IDS/IPS, and related tools; coordinating containment and eradication with system

Qualifications

• Bachelor’s degree with 5+ years in cybersecurity or equivalent.
• Experience in incident response, SOC operations, or security-event investigation.
• Experience analyzing cybersecurity events to determine response.
• Experience coordinating incidents across technical teams and stakeholders.
• U.S. Citizenship and an Active Secret clearance required.
• Willingness to participate in after-hours incident response.

Responsibilities

• Support the full incident-response lifecycle from detection to post-incident activities.
• Investigate incidents affecting NIPRNet and SIPRNet environments.
• Analyze security data from SIEM, IDS/IPS, firewalls, and endpoint-security tools.
• Contain, eradicate, recover, and coordinate with system owners and technical teams.
• Collect and preserve technical evidence and maintain incident records.
• Provide status updates during active investigations and assist with lessons learned.
• Participate in after-hours incident response as required.

Skills

Incident response

Security Operations Center (SOC)

Threat analysis

Evidence collection

Communication under pressure

Team coordination

Education

Bachelor’s degree in cybersecurity or related field

Tools

SIEM platforms

Endpoint security

Firewalls

IDS/IPS

Web security

Antispam

Malware protection

Job description

Leidos is seeking an experienced Incident Response Analyst to support the Defense Manpower Data Center **(DMDC)****CyberPRIMES **program. Leidos is a major partner on the contract and will provide a substantialportionof the cybersecurity workforce supporting the Defense Human Resources Activity (DHRA) and DMDC.

The Incident Response Analyst will investigate and respond to cybersecurity events and incidents affecting DHRA systems and networks. This position supports the full incident-response lifecycle—from detection and analysis through containment, eradication, recovery, and post-incident activities—and works closely with Security Operations Center analysts, Cybersecurity Service Providers, system owners, and technical teams during active cybersecurity incidents.

Work Locations:

• Mark Center, Alexandria, Virginia
• Department of Defense Center – Monterey Bay, Seaside, California

Clearance:

Active Secret security clearance required at time of consideration. U.S. Citizen is a must.

Mission Environment

DMDC supports the Defense Human Resources Activity within the Office of the Under Secretary of Defense for Personnel and Readiness (OUSD(P&R)) and maintains the Department of Defense’s largest and most comprehensive central repository of personnel, manpower, casualty, pay, entitlement, personnel security, identity, readiness, training, and related data.

The DHRA Information Technology (IT) environment includes approximately 15,000 network and endpoint devices supporting more than 600 Government-Off-The-Shelf (GOTS) applications and approximately 100 Risk Management Framework (RMF) authorization boundaries managed through the Enterprise Mission Assurance Support Service (eMASS). Incident-response operations support both the Non-classified Internet Protocol Router Network (NIPRNet) and Secret Internet Protocol Router Network (SIPRNet) environments. Analysts must be able to move quickly from security-event identification into investigation and coordinated response whilemaintainingaccuraterecords, preserving evidence, and keeping Government stakeholders informed.

Primary Responsibilities:

• Support preparation, detection, analysis, containment, eradication, recovery, and post-incident activities for cybersecurity events and incidents.
• Investigate cybersecurity incidents affecting NIPRNet and SIPRNet environments.
• Perform proactive security monitoring and analysis toidentify potential intrusion attempts and other malicious activity.
• Analyze security information from Security Information and Event Management (SIEM) platforms, endpoint-security capabilities, firewalls, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), web-security systems, antispam capabilities, malware-prevention systems, and related enforcement technologies.
• Recognize potential intrusion attempts, malicious activity, or other cybersecurity conditions requiring immediate investigation or mitigation.
• Assess cybersecurity events todeterminescope, potential impact, affected systems, andrequiredresponse actions.
• Support containment and mitigation of active cybersecurity threatsin accordance withapproved Government procedures.
• Coordinate eradication and recovery activities with system owners, administrators, network personnel, cybersecurity teams, and other technical stakeholders.
• Collect and preserve technical evidence associated with cybersecurity events and incidents.
• Maintain complete andaccurateincident records, timelines, supporting evidence, investigative findings, response actions, and status information.
• Develop and contribute to required cybersecurity event and incident reporting.
• Coordinate incident-response activities with Security Operations Center analysts, Cybersecurity Service Providers (CSSPs), system owners, technical teams, and Government stakeholders.
• Support escalation of significant cybersecurity events and incidentsin accordance withestablished procedures.
• Provide timely status updates during active investigations and incident-response activities.
• Support post-incident analysis and lessons learned toidentify opportunities to improve monitoring, detection, response procedures, and defensive capabilities.
• Participate in after-hours incident response when assigned and meet the contract-required one-hour recall requirement.

Basic Qualifications:

• Bachelor’s degree and 5 or more years of relevant cybersecurity experience. Specific experience, education and training may be considered in lieu of degree.
• Experience supporting cybersecurity incident response, Security Operations Center operations, cyber defense, or security-event investigation.
• Experience performing analysis of cybersecurity events and determiningappropriate responseor escalation actions.
• Experience supporting incident containment, eradication, recovery, and post-incident activities.
• Experience monitoring and analyzing enterprise cybersecurity tools and security telemetry.
• Experience documenting incident timelines, investigative findings, evidence, response actions, and status.
• Experience coordinating cybersecurity incidents across technical teams and stakeholder organizations.
• Working knowledge of network, endpoint, and enterprise cybersecurity monitoring concepts.
• Ability to recognize potential intrusion activity and support rapid mitigation of cybersecurity threats.
• Ability to communicate clearly during active cybersecurity incidents andmaintainaccuratedocumentation under time-sensitive conditions.
• Ability to support after-hours incident response and the required one-hour recall when assigned.
• U.S. Citizenshiprequired.
• Active Secret security clearancerequired.

Preferred Qualifications:

• Experience supporting cybersecurity incident response within Department of Defense or Federal environments.
• Experience responding to incidents in both unclassified and classified network environments.
• Experience with Security Information and Event Management platforms and enterprise security-monitoring capabilities.
• Experience analyzing endpoint-security,firewall, Intrusion Detection System, Intrusion Prevention System, web-security, antispam, or malware-prevention data.
• Experience supporting evidence collection and preservation during cybersecurity investigations.
• Experience coordinating incident response with Security Operations Center personnel, Cybersecurity Service Providers, system owners, network teams, and other technical organizations.
• Experienceoperatingin a 24x7 cybersecurity operations environment or supporting after-hours incident response.
• Familiarity with Department of Defense cybersecurity incident-response processes and requirements.
• Familiarity with DHRA, DMDC, or comparable Department of Defense enterprise environments.

If you’re looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo — because the mission demands it. We’re not hiring followers. We’re recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We’re already at step 30 — and moving faster than anyone else dares.

Pay Range:

Pay Range $87,100.00 - $157,450.00

The Leidos pay range for this job level is a general guideline onlyand not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.