Senior Incident Response Analyst

Peraton; Herndon (VA); On-site; USD 104,000 - 166,000; Full time

Job summary

Peraton is seeking a Senior Incident Response Analyst to lead hands-on incident response for critical Califonia health systems. You will own detection engineering, threat hunting, and serve as backup incident manager, coordinating with the client and our Security Services team.

You will guide playbooks, lead on-call rotation, and drive SIEM/SOAR work across cloud and on-prem environments. The role emphasizes protecting PII/PHI and complying with regulatory timelines.

Qualifications

• Bachelor's degree in cybersecurity or computer science; 4 years additional experience optional.
• 8+ years of cybersecurity experience with hands-on incident response leadership.
• Active GCIH or GCIA certification.
• Hands-on with enterprise SIEM and SOAR platforms (Splunk, MS Sentinel) including detection engineering.
• Threat hunting experience using MITRE ATT&CK; malware triage and forensics basics.
• Experience leading incidents as the incident lead, with evidence handling and post-incident reporting.
• Knowledge of NIST SP 800-61 and scripting for response automation.

Responsibilities

• Lead end-to-end incident response including triage, containment, eradication, and recovery.
• Develop and exercise incident response playbooks and runbooks.
• Drive SIEM/SOAR content development, log onboarding, alert tuning, and detection engineering.
• Conduct threat hunting mapped to MITRE ATT&CK and turn findings into detections.
• Coordinate evidence handling, chain of custody, reporting, and post-incident reviews.
• Meet contract clock with timely notifications and breach reporting timelines.
• Provide status reports to security leadership and support vulnerability management.

Skills

Incident response leadership

Threat hunting MITRE ATT&CK

Scripting for response automation

GCIH/GCIA certification

Incident lead/commander experience

Detection engineering experience

PII/PHI handling knowledge

Education

Bachelor's degree in cybersecurity or computer science

Tools

Splunk

Microsoft Sentinel

Job description

Senior Incident Response Analyst

Job Locations: US

Requisition ID: 2026-169782

Position Category: Cyber Security

Clearance: No Clearance Required

Responsibilities

Position Is Contingent Upon Award

Peraton Labs is hiring a Senior Incident Response Analyst to lead hands-on incident response for the Covered California and CalHEERS environments, own detection engineering and threat hunting, and serve as backup incident manager in coordination with the client's Information Security Officer and our Security Services Manager. You will carry the primary on-call rotation.

You will work with Covered California security leadership, infrastructure and application teams, our on-site security engineering and GRC colleagues, and an on-call digital forensics examiner. The goal is that incidents in a system holding the PII, PHI, and federal tax information of millions of Californians are detected early, contained fast, reported inside contractual and regulatory deadlines, and genuinely learned from.

What You Will Do In This Role

• Lead incident response end to end. Own triage, containment, eradication, recovery, and post-incident review, and serve as backup incident manager in coordination with the client Information Security Officer and the Security Services Manager.
• Build and exercise the playbooks. Develop and maintain incident response playbooks and runbooks, and exercise them through tabletop and functional drills.
• Own detection and monitoring. Drive SIEM and SOAR content development, log source onboarding, alert tuning, and detection engineering across cloud and on-premises telemetry.
• Hunt proactively. Conduct threat hunting mapped to MITRE ATT&CK, and turn hunt findings into durable detections.
• Run defensible investigations. Coordinate evidence handling and chain of custody, communications, escalation, and reporting; produce post-incident reports and lessons-learned; engage the digital forensics examiner when a matter requires formal forensic examination or evidence for legal, HR, or privacy proceedings.
• Meet the contract's clock. Build and operate response procedures that satisfy the engagement's tight notification obligations, including notification within one hour when personnel no longer require system access, and the Privacy Addendum's breach-reporting timelines.
• Report to leadership and support adjacent work. Provide incident status and escalation reporting to security leadership on defined timelines, and support vulnerability management and logging and monitoring coordination.

Qualifications

Required:

• Bachelor's degree in cybersecurity or computer science. In lieu of a degree, an additional 4 years of relevant experience will be considered.
• 8+ years of cybersecurity experience with demonstrated hands-on incident response leadership.
• Active GCIH or GCIA certification.
• Hands-on experience with enterprise SIEM and SOAR platforms (for example Splunk or Microsoft Sentinel), including detection engineering, log source onboarding, and alert tuning.
• Demonstrated threat hunting experience using MITRE ATT&CK, plus malware triage and network and host forensics fundamentals.
• Demonstrated experience leading incidents as the incident lead or commander, including evidence handling, chain of custody, executive incident communication, and post-incident reporting.
• Working knowledge of NIST SP 800-61 incident handling practice within a NIST SP 800-53 Rev. 5 control context, and scripting ability for response and detection automation.
• US Citizenship and the abillity to pass a California criminal background clearance (Gov. Code *1043 / 10 CCR *6456) before starting work or accessing any confidential information, PII, PHI, federal tax information, or financial information.

Desired:

• GCFA certification. CISSP, GCED, or GNFA are also valued.
• Incident response experience in environments containing PII, PHI, and federal tax information.
• Experience in CMS-regulated environments or state health benefit exchange environments.
• Familiarity with ARC-AMPE and IRS Publication 1075 incident handling and reporting obligations.
• Experience in California state government or comparable public-sector environments.
• Experience coordinating with external forensic providers, law enforcement, and regulators during an incident.
• Experience building or maturing a detection engineering practice, including detection-as-code.

Peraton Overview

Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world's leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees do the can't be done by solving the most daunting challenges facing our customers. Visit peraton.com to learn how we're keeping people around the world safe and secure.

Target Salary Range

$104,000 - $166,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual's experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.

EEO

EEO: Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.