Senior Incident Response Analyst - Remote (AWS/Splunk/EDR)

phia, LLC; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Medical Insurance

Dental Insurance

Vision Insurance

Life Insurance

Short Term Disability

Long Term Disability

401k Retirement Savings Plan with Auto

Paid Holidays

PTO

Tuition and Professional Development

Job summary

phia LLC is seeking a mission-driven Senior Incident Response Analyst to serve as a hands-on responder supporting a federal financial regulatory agency’s cybersecurity operations. You will lead incidents involving APT/FIN actors and cloud-based threats (AWS), mentor analysts, and author clear, defensible reports for a demanding client.

You will work with government staff, independently with some guidance, and share a weekly on-call rotation with the team, while supporting SOC integration and

Qualifications

• 5+ years of hands-on incident response experience.
• Experience handling APT/FIN actors and cloud-based threats in IR capacity.
• Experience with executive-level client interaction and report QA.

Responsibilities

• Triage, investigate, contain, and remediate cybersecurity incidents.
• Lead incidents end-to-end as senior analyst and mentor juniors.
• Respond to APT/FIN threats and cloud-based threats (AWS).
• Investigate in Splunk and Defender EDR; build Splunk SOAR playbooks.
• Map activity to MITRE ATT&CK and follow NIST 800-61.
• Author clear incident reports in Archer and QA team submissions.

Skills

Incident response

APT/FIN threat actors

Splunk SPL

Microsoft Defender EDR

Cloud (AWS) threat response

SOAR playbooks

Python scripting

Linux shell

Mentoring

Education

Bachelor’s Degree

Tools

Splunk

GitHub

Archer (RSA)

AWS CloudTrail/GuardDuty

Job description

phia LLC is seeking a mission-driven Senior Incident Response Analyst to serve as a hands-on responder supporting a federal financial regulatory agency’s cybersecurity operations. You will lead incidents involving APT/FIN actors and cloud-based threats (AWS), mentor analysts, and author clear, defensible reports for a demanding client.

You will work with government staff, independently with some guidance, and share a weekly on-call rotation with the team, while supporting SOC integration and