Senior Cyber Security Incident Response Analyst

This role is responsible for conducting highly technical investigations into cyber security incidents, managing the full incident lifecycle from initial detection and triage through containment, eradication, recovery, and post-incident review. Coordinates incident response activities with GCC teams, supported unit commanders, NETCOM, and ARCYBER; working with the forensics SME to investigate incidents and analyze digital evidence; documenting incident scope, impact, root cause, and remediation actions; maintaining complete case records; and developing response playbooks, lessons learned, and process improvements to strengthen the GCC Cybersecurity Service Provider (CSSP) mission.

 Responsibilities include: 

• Manage the full cyber incident lifecycle — from initial detection and triage through containment, eradication, recovery, and post-incident review — ensuring all actions are executed in accordance with NIST SP 800-61 Rev. 3 and Army incident response procedures. 

• Coordinate with internal GCC teams, supported unit commanders, NETCOM, and ARCYBER during active cyber incidents, serving as the primary point of contact for incident status updates and ensuring timely, accurate communication. 

• Produce comprehensive analysis reports that document the timeline, scope, impact, root cause, and remediation actions for each cyber incident. 

• Maintain accurate and up-to-date incident tracking records, ensuring all case data, evidence artifacts, analyst notes, and closure documentation meet GCC quality standards and audit requirements. 

• Ability to conduct post-incident reviews and lessons-learned sessions following significant cyber events, identifying process gaps, detection failures, and response inefficiencies, and translating findings into actionable improvements for the GCC CSSP. 

• Serve as a technical leader by providing mentorship to associate-level staff, performing quality assurance reviews of team output. 

• Develop, maintain, and exercise incident response playbooks for common attack scenarios (ransomware, phishing, credential theft, insider threat), ensuring procedures remain current with the evolving threat landscape, Army policy requirements, and mission success. 

Experience: 

• Active DoD Top Secret/SCI clearance 

• Experience with ServiceNow Security Operations (SecOps) module for incident tracking and SLA management 

• Proficiency with Elastic Stack for SIEM-based alert triage, event correlation, and incident timeline reconstruction 

• Working knowledge of NIST SP 800-61 Rev.3 Computer Security Incident Handling Guide and DoD/Army incident response policy frameworks 

• Experience developing and exercising incident response playbooks for common cyber-attack scenarios in a DoD environment 

• Familiarity with digital forensics tools and techniques for evidence collection, chain of custody, and artifact analysis 

 Certification Requirements:  

• DoW 8140 Compliance – DCWF 531 Advanced prior to start date.