Cybersecurity Incident Response Analyst

The Cybersecurity Incident Response Analyst supports integrated cyber defense and SOC incident response activities by monitoring, analyzing, detecting, and responding to cyber events and incidents. This onsite role in Washington, DC focuses on high-impact incident handling, network and host triage, and remediation with strict chain-of-custody.

Key Responsibilities

• Apply expertise in monitoring, analyzing, detecting, and responding to cyber events and incidents across information systems and networks.
• Support integrated, dynamic cyber defense by leveraging cybersecurity solutions to deliver operational services such as intrusion detection and prevention, situational awareness of network intrusions, security event and data spillage response actions, and incident response operations.
• Contribute to developing innovative ideas and principles for unusually complex problems, providing highly creative solutions.
• Lead and coordinate response activities for major, high-impact incidents by generating clear, concise recommendations and facilitating professional communications across stakeholders.
• Collaborate with security teams to develop, tune, automate, and enhance network and host-based security devices, and support SOC operations for client cyber intrusions.
• Perform extensive network and host triage, maintain strict chain-of-custody, analyze documentation and reports, and carry out remediation as required.

Required Qualifications

• 5+ years of experience in cybersecurity or information technology disciplines.
• 3+ years of experience with any of the following: Advanced Persistent Threat (APT) hunting, penetration testing, digital forensics, malware reverse engineering, SOC operations, or incident response.
• Experience with incident response tools including SentinelOne, Splunk, or Microsoft Defender.
• Ability to adapt communication style and messaging for professionals at all leadership levels.
• Secret clearance.
• Bachelor’s degree.
• One or more certifications: OSCP, CCNA-Security, CySA+, GCIH, GICSP, or PenTest+.

Preferred (Nice If You Have)

• Ability to detect and search for MITRE ATT&CK TTPs and common attacker methodologies using PCAP data and tools such as Wireshark.
• Ability to analyze SIEM alerts to identify issues for investigation and remediation.
• Ability to profile and track malicious actors in coordination with threat intelligence support teams.
• Ability to review and analyze security log files from cloud, network, endpoint, or ICAM sources.
• Self-driven working style with the ability to operate independently and manage multiple tasks concurrently.
• TS/SCI clearance.

Technologies

• SentinelOne
• Splunk
• Microsoft Defender

Clearance and Security Notice

Applicants selected will be subject to a security investigation and may need to meet eligibility requirements for access to classified information. A Secret clearance is required.

Work Model

This position is onsite. Work will primarily be performed full-time at a customer facility, where employees will collaborate directly with colleagues and customers as required by the role.

Employees working virtually are generally expected to have their cameras on during meetings.

Compensation

USD 86,800 - 198,000 per year.

Benefits

• Health, life, disability, financial, and retirement benefits.
• Paid leave.
• Professional development.
• Tuition assistance.
• Work-life programs.
• Dependent care.
• Recognition awards program.
• Full-time and part-time employees working at least 20 hours per week on a regular basis are eligible to participate in Booz Allen’s benefit programs.

Identity Verification and Interview Requirements

• Completion of an identity verification process that leverages advanced biometrics and artificial intelligence to ensure authenticity and protect against identity fraud.
• Interview and assessment sessions are expected to be on camera.
• The employer reserves the right to take your picture to verify your identity and prevent fraud.

Candidate AI Usage Policy

Use of artificial intelligence (AI) or other tools to assist with responses during interviews (in-person or virtual) is prohibited unless permission is explicitly provided.

Non-Discrimination Commitment

All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran, or any other status protected by applicable federal, state, local, or international law.