Mid Cyber Incident Analyst — Hybrid (Arlington)

Everforth, Inc.; Arlington (VA); Hybrid; USD 110,000 - 150,000; Full time

Job summary

Everforth ECS in Arlington, VA, seeks a Mid Cybersecurity Incident Analyst to join our hybrid team supporting CISA's TESS program. You will analyze active incidents, identify vulnerabilities, and provide actionable guidance to JCDC partners across IT, OT/ICS, cloud and AI environments.

You will collaborate with DHS CISA teams, define data sources, write detection rules, and contribute to threat hunting and incident response capabilities for FCEB, CI, and SLTT stakeholders.

Qualifications

• Minimum 6+ years of experience in threat intelligence, cyber security, incident response, or similar.
• Strong understanding of computer and network fundamentals.
• Experience defining data sources and writing detection rules for discovering malicious behavior.
• Excellent written and oral communication skills.
• Familiarity with MITRE ATT&CK and other cyber frameworks.

Responsibilities

• Perform analysis on active cyber incidents, events and vulnerabilities to provide guidance and targeted recommendations for mitigation.
• Assist in developing written guidance for JCDC partners on active vulnerabilities.
• Stay current with emerging cybersecurity technologies and trends to improve threat detection and mitigation.
• Translate technical insights into actionable guidance tailored to stakeholder needs.
• Support mapping of cyber threats to frameworks like MITRE ATT&CK and other standards.

Skills

Threat intelligence

Incident response

Security analysis

Communication

MITRE ATT&CK awareness

Tools

Elasticsearch

Job description

Everforth ECS in Arlington, VA, seeks a Mid Cybersecurity Incident Analyst to join our hybrid team supporting CISA's TESS program. You will analyze active incidents, identify vulnerabilities, and provide actionable guidance to JCDC partners across IT, OT/ICS, cloud and AI environments.

You will collaborate with DHS CISA teams, define data sources, write detection rules, and contribute to threat hunting and incident response capabilities for FCEB, CI, and SLTT stakeholders.