Cyber Incident Analyst

Lafayette Group is seeking experienced professionals to provide advanced consulting support for federal cybersecurity programs. The Cyber Incident Analyst provides deep technical analysis during active cyber incidents, including insights into vulnerabilities, adversarial tactics, and mitigation strategies across diverse environments like IT, OT/ICS, cloud, and AI systems. This role requires demonstrated expertise in incident monitoring and response coordination, combined with strong consulting skills.

This position engages with partners across government, industry, and critical infrastructure to provide guidance and analysis on active cyber threats. This position requires the ability to coordinate among diverse stakeholder groups, evaluate cyber intelligence for impact, conduct in-depth technical research, and translate technical data into guidance that informs decision‑making.

The ideal candidate for this role is an experienced, collaborative team member with deep expertise in cybersecurity operations with an innate curiosity to learn, and the drive to excel with a team of like‑minded colleagues in a dynamic environment. This position will:

• Perform analysis on active cyber incidents, events and vulnerabilities to provide guidance and targeted recommendations for mitigation.
• Support the development of written guidance and recommendations to assist client’s partners with solutions for active and ongoing cyber vulnerabilities.
• Remain current with emerging technologies and trends in cybersecurity and apply this knowledge to improve threat detection and mitigation efforts.
• Through hands‑on analysis provide insights into vulnerabilities, adversarial tactics, and mitigation strategies across diverse environments like IT, OT/ICS, cloud, and AI systems.
• Assist with mapping technical insights on cyber threats to frameworks like MITRE ATT&CK and other cyber frameworks.
• Support the translation of strategic products into clear, practical formats that are tailored to the specific needs and operational constraints of different stakeholder groups, including large and small jurisdictions and critical infrastructure (CI) partners.
• Assist in the tailoring of vulnerability mitigation recommendations and contextualized examples to stakeholders to address implementation challenges and encourage rapid adoption.

• Bachelor's or Master’s degree in cybersecurity, information technology, political science, or a related field.
• 6+ years of professional experience in cyber analysis, threat intelligence, cyber security, incident response, or similar role.
• Demonstrated expertise in cyber incident response coordination, incident monitoring, and operational reporting.
• Strong understanding of current cyber threats/exploits, attack methodology, and detection techniques using a wide variety of security products including COTS and open source.
• Strong understanding of computer and network fundamentals; working understanding of computer architecture, operating systems, vulnerabilities, encryption, etc.
• Experience defining data sources and writing detection rules for discovering malicious behavior.
• Possession of excellent analytical and critical thinking skills with the ability to remain open‑minded, flexible and curious in problem‑solving approach.
• Possession of excellent oral and written communication skills.
• Ability to manage time effectively to meet deadlines, adhere to project plans, and work on several projects simultaneously; strong organizational skills and attention to detail.
• Proficient with Microsoft Office Suite.
• Active TS security clearance and SCI eligibility; US citizenship with the ability to obtain and maintain DHS Suitability (EOD).

• Familiarity with the .gov Cyber Mission space and legal constraints applicable to civilian Government Agencies (e.g., FISMA).
• Experience collecting, analyzing, and categorizing threat intelligence data from multiple sources to author actionable intelligence reports.
• Familiarity with at least one scripting language such as Python, and capable of manipulating data, interfacing with APIs, automating repetitive tasks, etc.
• Ability to interpret complex…