The Role
Tier-2 Incident Response Analyst supporting AOUSC in a hybrid DC role. Perform live triage, log correlation, detection rule refinement, and decode/decrypt obfuscated payloads using Python and PowerShell. Use Velociraptor, Splunk ES, and Sentinel while following NIST incident handling guidance. Active Public Trust and SANS GCIH or GCIA required.
Summary Generated by Built In
cFocus Software seeks a Incident Response Analyst (Tier 2) to join our program supporting the Administrative Office of the United States Courts (AOUSC). This position is Hybrid with the onsite location being in Washington, DC. This position requires a Public Trust clearance.
Qualifications:
Qualifications:
- Active Public Trust clearance
- B.S. Computer Science, Information Technology, or a related field
- 3+ years of experience in an IR role.
- 2+ years’ experience using Python and PowerShell scripts for decoding/decryption of obfuscated payloads.
- 2 years of experience in performing live triage, log correlation, detection rule refinement, to include usage of Velociraptor, Splunk ES and Sentinel.
- 1 year of experience in federal incident handling guidelines as specified in NIST CSWP-29: CSF, and NIST SP-800-61 Computer Security Incident Handling Guide.
- Active SANS GCIH or GCIA certification
Skills Required
- Active Public Trust clearance
- B.S. Computer Science, Information Technology, or a related field
- 3+ years of experience in an IR role
- 2+ years experience using Python and PowerShell for decoding/decryption of obfuscated payloads
- 2 years performing live triage, log correlation, detection rule refinement, including usage of Velociraptor, Splunk ES and Sentinel
- 1 year experience with federal incident handling guidelines (NIST CSWP-29: CSF and NIST SP-800-61)
- Active SANS GCIH or GCIA certification
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Established in 2006, cFocus Software automates FedRAMP compliance and develops government chatbots for the Azure Government Cloud, Office 365, and SharePoint. cFocus Software is the exclusive vendor of ATO (Authority To Operate) as a Service™, which automates FedRAMP compliance for the Azure Government Cloud and Office 365. Contact Us for a demo of ATO as a Service™ or a FREE government chatbot proof of concept project today!
