Remote-Optional Principal Incident Response Analyst

Amtrak; United States; Hybrid; USD 125,000 - 161,000; Full time

Benefits offered by this job

Health and Wellbeing

401K with Employer Match

Paid Time Off

Rail Pass Privileges

Job summary

Amtrak is seeking a Principal Cyber Threat Incident Response Analyst to join the Cyber Fusion Center. You will coordinate incident response across the organization, lead investigations, and execute response playbooks to reduce business risk.

You will work with security leadership and cross-functional teams to ensure timely resolution of security incidents, build playbooks, and improve Amtrak's cyber resilience through proactive safety and security practices.

Qualifications

• Bachelor’s Degree in Computer Science, Information Systems, Cybersecurity, or related field; or 7–10 years relevant experience.
• Experience in incident response, vulnerability management, digital forensics, malware and code reverse engineering, memory and fileless malware analyses, nation-state malware investigations, network or cloud security, and penetration testing.
• One incident response centric certification from the listed GIAC/EC‑Council/eLearnSecurity/NICCS/SEI families.

Responsibilities

• Provide incident response support to detect and respond to threats across the organization.
• Lead complex investigations, coordinate with stakeholders, and apply incident response playbooks.
• Perform digital forensics, memory analysis, malware analysis, and containment activities.
• Develop, refine, and maintain playbooks and procedures aligned to industry best practices.
• Support tabletop exercises, crisis management, and cross‑functional incident response efforts.
• Review vulnerability and penetration testing results to identify potential incidents.

Skills

Incident Response

Digital Forensics

Malware Analysis

Threat Hunting

MITRE ATT&CK

Log Correlation

Network Forensics

Cloud Security

Written Communication

Team Collaboration

Education

Bachelor's Degree in Computer Science

Job description

Amtrak is seeking a Principal Cyber Threat Incident Response Analyst to join the Cyber Fusion Center. You will coordinate incident response across the organization, lead investigations, and execute response playbooks to reduce business risk.

You will work with security leadership and cross-functional teams to ensure timely resolution of security incidents, build playbooks, and improve Amtrak's cyber resilience through proactive safety and security practices.