Remote Senior Incident Response Lead - APT/Cloud

PHIA; United States; Remote; USD 150,000 - 205,000; Full time

Job summary

PHIA is seeking a mission-driven Senior Incident Response Analyst to join our federally focused cybersecurity operations team. You will act as the most senior responder on the IR team, handling incidents involving APT/FIN actors and cloud-based threats, mentoring junior analysts, and delivering defensible client-facing reports with a focus on quality and detail.

You will work with government staff, operate in a remote US environment, and share a weekly on-call rotation.

Qualifications

• 5+ years incident response experience.
• Experience with APT/FIN actors and cloud threats in IR capacity.
• Experience with client engagement and professional demeanor.
• Knowledge of Defender EDR or equivalent enterprise EDR.
• GIAC GCIH or equivalent certifications; clearance as applicable.

Responsibilities

• Respond to incidents end-to-end: triage, investigate, contain, remediate.
• Lead incidents as the most senior analyst and review junior analysts’ work.
• Respond to APT/FIN actors and cloud-based threats (AWS/Azure) from detection to resolution.
• Investigate in Splunk SIEM and Defender EDR; develop/playbook automation in Splunk SOAR.
• Prepare clear incident reports in Archer and perform QA on submissions.
• Share weekly after-hours on-call rotation and mentor the team.

Skills

IR experience

APT/FIN actor IR

EDR experience

SOC practices

Automation/SOAR

Client-facing

Reporting/writing

Mentoring

Education

Bachelor's Degree

Tools

Splunk

Splunk SOAR

GitHub

Archer

AWS

Microsoft Defender EDR

Job description

PHIA is seeking a mission-driven Senior Incident Response Analyst to join our federally focused cybersecurity operations team. You will act as the most senior responder on the IR team, handling incidents involving APT/FIN actors and cloud-based threats, mentoring junior analysts, and delivering defensible client-facing reports with a focus on quality and detail.

You will work with government staff, operate in a remote US environment, and share a weekly on-call rotation.