Senior Incident Response Lead (Remote, AWS & Splunk)

Phia LLC; Fairfax (VA); Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Medical Insurance

Dental Insurance

Vision Insurance

Life Insurance

401k with company match

Paid Holidays

PTO

Professional Development Assistance

Job summary

phia LLC is seeking a Senior Incident Response Analyst to serve as the hands-on lead on complex security incidents for a federal financial regulatory client. You will drive containment, eradication, and reporting for APT and FIN actors, including cloud-based threats (AWS).

The role includes mentoring teammates, coordinating with government staff, and contributing to the ongoing improvement of IR processes and documentation in Archer and GitHub.

Qualifications

• 5+ years of hands-on incident response experience.

Responsibilities

• Respond to incidents with triage, investigation, containment and remediation.
• Lead incidents end-to-end as the most senior analyst and mentor juniors.
• Handle APT/FIN threat actors and cloud-based threats (AWS/Azure) from detection to eradication.
• Work the SOC stack: Splunk SIEM, Microsoft Defender EDR, and build Splunk SOAR playbooks; map activity to MITRE ATT&CK; reference NIST 800-61.
• Recommend and implement process improvements with government staff and assist auditors.
• Participate in weekly after-hours on-call rotation.
• Author clear incident reports in Archer and track investigations in GitHub; perform QA on submissions.

Skills

Incident response

APT/FIN actor handling

EDR experience

SOC best practices

Mentoring/leadership

Python scripting

Splunk SPL

GitHub

Archer GRC

MITRE ATT&CK mapping

AWS cloud threats

On-call rotations

Technical writing

Education

Bachelor's Degree

GIAC GCIH or GCFA/GCFR/GNFA/GREM/EC-Council ECIH

Tools

Microsoft Defender EDR

CrowdStrike

SentinelOne

Splunk

Splunk SOAR

GitHub

Archer (RSA)

AWS (CloudTrail/GuardDuty)

Job description

phia LLC is seeking a Senior Incident Response Analyst to serve as the hands-on lead on complex security incidents for a federal financial regulatory client. You will drive containment, eradication, and reporting for APT and FIN actors, including cloud-based threats (AWS).

The role includes mentoring teammates, coordinating with government staff, and contributing to the ongoing improvement of IR processes and documentation in Archer and GitHub.