Incident Response Analyst – Remote (DoD)

Leidos; Alexandria (VA); On-site; USD 87,000 - 157,000; Full time

Job summary

Leidos is seeking an experienced Incident Response Analyst to support the DMDC CyberPRIMES program. The role covers the full incident-response lifecycle, from detection to post-incident activities, and requires active Secret clearance and U.S.

citizenship. Primary responsibilities include investigating incidents across NIPRNet/SIPRNet, proactive security monitoring, and coordinating with Security Operations Center analysts and government stakeholders.

Qualifications

• Experience supporting cybersecurity incident response, SOC operations, or cyber defense.
• Experience analyzing cybersecurity events and determining appropriate response.
• Experience documenting incident timelines, evidence, and status.
• Experience coordinating incidents across technical teams and stakeholders.
• Active Secret clearance and U.S. citizenship required.

Responsibilities

• Support preparation, detection, analysis, containment, eradication, recovery, and post-incident activities.
• Investigate incidents affecting NIPRNet and SIPRNet environments.
• Monitor and analyze enterprise security telemetry and tools.
• Assess events to determine scope, impact, and required actions.
• Coordinate containment and mitigation with system owners and technical teams.
• Collect and preserve technical evidence and maintain incident records.
• Contribute to incident reporting and escalation procedures.
• Provide timely status updates during investigations.
• Assist post-incident analysis and lessons learned.
• Participate in after-hours incident response as needed.

Skills

Incident response

SOC operations

Security events analysis

Documentation & timelines

Clear communication

Education

Bachelor’s degree + 5+ years cyber experience

Job description

Leidos is seeking an experienced Incident Response Analyst to support the DMDC CyberPRIMES program. The role covers the full incident-response lifecycle, from detection to post-incident activities, and requires active Secret clearance and U.S.

citizenship. Primary responsibilities include investigating incidents across NIPRNet/SIPRNet, proactive security monitoring, and coordinating with Security Operations Center analysts and government stakeholders.