Senior Cybersecurity Defense Analyst III

invictusic; Alexandria (VA); On-site; USD 120,000 - 180,000; Full time

Job summary

invictusic in Alexandria, VA seeks a Senior Cyber Defense Analyst III to lead advanced investigations and incident response for DoD/IC environments. TS/SCI with CI polygraph is required, plus MITRE ATT&CK expertise and mentoring responsibilities.

In this senior role you will coordinate containment, develop runbooks, and communicate findings to SOC teams and government stakeholders. Expect cross-functional collaboration with engineering and threat teams.

Qualifications

• Bachelor's degree in a technical discipline; an additional 4 years may substitute for the degree
• Minimum six (6) years of relevant cybersecurity experience
• Hands-on experience in cybersecurity investigations and incident response in enterprise environments
• Strong knowledge of network/host-based investigations and MITRE ATT&CK
• Experience developing or improving SOC procedures, runbooks or analyst training materials
• Experience serving as escalation point or mentor for cyber defense analysts
• DoD 8570 IAT II or IAM II certification
• Experience in DoD/IC environments
• Current TS/SCI clearance with CI polygraph

Responsibilities

• Lead and perform advanced investigations of security events across multiple domains
• Conduct cyber defense incident triage, including scope, urgency, and escalation
• Support incident handling from detection through containment and recovery
• Correlate data across sources to identify affected systems and threats
• Preserve intrusion artifacts per procedures and communicate findings to stakeholders
• Mentor junior analysts and review investigations for quality
• Lead portions of incident response activities and post-incident reviews
• Proactive threat hunting to identify new threats
• Develop and improve analyst runbooks and playbooks

Skills

Incident response

Cybersecurity investigations

Mentoring

Technical escalation

Runbooks & procedures

Education

Bachelor's degree in technical discipline

DoD 8570 IAT II or IAM II certification

Tools

MITRE ATT&CK framework

SOC playbooks

Job description

Title: Senior Cyber Defense Analyst III

Location: Alexandria, VA

Clearance: TS/SCI with the ability to obtain and maintain a CI polygraph

Job Details:

• Perform and lead advanced investigation of complex security events and incidents across network, endpoint, identity, firewall, vulnerability, and other available telemetry
• Perform cyber defense incident triage, including validation, enrichment, determination of scope, urgency, potential impact, and appropriate escalation
• Support incident handling across detection, investigation, analysis, containment/remediation coordination, recovery, and reporting in accordance with established authorities and procedures
• Correlate incident and security data across multiple sources to identify affected systems, users, vulnerabilities, adversary activity, and related events
• Collect and preserve relevant intrusion artifacts and investigative evidence in accordance with established procedures
• Communicate incident status, findings, risk, and recommended actions to SOC personnel, technical teams, management, and government stakeholders as appropriate
• Serve as a senior technical escalation point to less expereinced team members and provide hands-on guidance during complex investigations
• Lead portions of incident response activities, including scoping, evidence analysis, containment recommendations, technical coordination, and post-incident review
• Conduct proactive analysis and threat hunting when warranted to identify related or previously undetected activity
• Develop, maintain, and improve analyst runbooks, investigative procedures, escalation criteria, incident playbooks, and shift-turnover practices
• Partner with threat analysts and engineering personnel to identify telemetry gaps, detection gaps, false positives, and opportunities for improved enrichment or automation
• Mentor junior analysts, support analyst qualification and exercises, and perform quality review of investigations and case documentation
• Translate incident lessons learned into improved detections, procedures, training, and defensive recommendations

Requirements:

• Bachelor's degree from an accredited institute in a technical discipline applicable to the position; an additional 4 years of may be substituted in lieu of a degree
• Minimum six (6) years of relevant experience in addition to education level
• Significant hands‑on experience conducting cybersecurity investigations and incident response in enterprise environments.
• Strong knowledge of network and host‑based investigation, common adversary tactics, techniques, and procedures, and the MITRE ATT&CK framework
• Experience developing or improving SOC procedures, incident playbooks, runbooks, or analyst training materials
• Experience serving as an escalation point, technical lead, or mentor for cyber defense analysts
• Must possess current DoD 8570 IAT II or IAM II certification
• Experience working in a DoD or IC environment
• Current active TS/SCI clearance, with the ability to obtain and maintain a CI polygraph

Equal Opportunity Employer/Veteran/Disabled