Senior Cybersecurity Defense Analyst III

Invictus International; Alexandria (VA); On-site; USD 130,000 - 190,000; Full time

Job summary

Invictus International is seeking a Senior Cyber Defense Analyst III in Alexandria, VA. The role leads complex investigations, incident triage, and response coordination across enterprise environments with a TS/SCI clearance and CI polygraph.

Responsibilities include mentoring junior analysts, developing SOC playbooks, and guiding cross-functional teams through containment, remediation, and post-incident reviews in a DoD/IC context.

Qualifications

• Bachelor's degree in a technical discipline; 4 years may substitute for degree.
• Minimum six years of relevant cybersecurity experience.
• Hands-on investigations and incident response in enterprise environments.
• Strong knowledge of network/host forensics and ATT&CK.
• Experience developing/improving SOC playbooks and runbooks.
• Escalation lead or technical mentorship experience.
• Must have DoD 8570 IAT II or IAM II certification.
• Experience in a DoD or IC environment; TS/SCI with CI polygraph.

Responsibilities

• Perform and lead advanced investigations across network, endpoint, identity and telemetry.
• Triage incidents: validate, enrich, scope, urgency, impact, escalation.
• Support detection, containment, remediation, recovery, reporting.
• Correlate data from multiple sources to identify affected assets and activity.
• Preserve intrusion artifacts per procedures and guidelines.
• Communicate status, risks and actions to SOC, teams, and government stakeholders.
• Serve as senior escalation point and guide junior analysts.
• Lead portions of incident response, containment and post-incident reviews.
• Conduct proactive threat hunting to identify new activity.
• Develop/maintain runbooks, procedures and escalation criteria.
• Collaborate with threat intel and engineering to close gaps.
• Mentor analysts and perform quality reviews of cases.

Skills

Cybersecurity investigations

Incident response

Mentoring

Threat hunting

Runbooks & playbooks

Stakeholder communication

Education

Bachelor's degree in technical field

Tools

MITRE ATT&CK

DoD 8570 IAT II/IAM II

SOC procedures/tools

Job description

Title: Senior Cyber Defense Analyst III

Location: Alexandria, VA

Clearance: TS/SCI with the ability to obtain and maintain a CI polygraph

Job Details:

• Perform and lead advanced investigation of complex security events and incidents across network, endpoint, identity, firewall, vulnerability, and other available telemetry


• Perform cyber defense incident triage, including validation, enrichment, determination of scope, urgency, potential impact, and appropriate escalation


• Support incident handling across detection, investigation, analysis, containment/remediation coordination, recovery, and reporting in accordance with established authorities and procedures


• Correlate incident and security data across multiple sources to identify affected systems, users, vulnerabilities, adversary activity, and related events


• Collect and preserve relevant intrusion artifacts and investigative evidence in accordance with established procedures


• Communicate incident status, findings, risk, and recommended actions to SOC personnel, technical teams, management, and government stakeholders as appropriate


• Serve as a senior technical escalation point to less expereinced team members and provide hands-on guidance during complex investigations


• Lead portions of incident response activities, including scoping, evidence analysis, containment recommendations, technical coordination, and post-incident review


• Conduct proactive analysis and threat hunting when warranted to identify related or previously undetected activity


• Develop, maintain, and improve analyst runbooks, investigative procedures, escalation criteria, incident playbooks, and shift-turnover practices


• Partner with threat analysts and engineering personnel to identify telemetry gaps, detection gaps, false positives, and opportunities for improved enrichment or automation


• Mentor junior analysts, support analyst qualification and exercises, and perform quality review of investigations and case documentation


• Translate incident lessons learned into improved detections, procedures, training, and defensive recommendations

Requirements:

• Bachelor's degree from an accredited institute in a technical discipline applicable to the position; an additional 4 years of may be substituted in lieu of a degree


• Minimum six (6) years of relevant experience in addition to education level


• Significant hands-on experience conducting cybersecurity investigations and incident response in enterprise environments.


• Strong knowledge of network and host-based investigation, common adversary tactics, techniques, and procedures, and the MITRE ATT&CK framework


• Experience developing or improving SOC procedures, incident playbooks, runbooks, or analyst training materials


• Experience serving as an escalation point, technical lead, or mentor for cyber defense analysts


• Must possess current DoD 8570 IAT II or IAM II certification


• Experience working in a DoD or IC environment


• Current active TS/SCI clearance, with the ability to obtain and maintain a CI polygraph

Equal Opportunity Employer/Veteran/Disabled