Senior Incident Response Analyst; Tier 3​/IR Lead

Status:
Active - Immediate Need

Location:

Fully remote - U.S. only (no time on the client site expected)

Focus Areas: Tier 3 Incident Response, APT/FIN Threat Actor Response, Cloud (AWS) Threat Response, Splunk & Splunk SOAR, Microsoft Defender EDR, and IR Reporting, QA & Mentoring

At phia we hire talented and passionate people who are focused on collaborative, meaningful work, providing technical and operational subject matter expertise and support services to our partners and clients. phia is seeking a mission-driven Senior Incident Response Analyst to serve as a hands-on responder supporting a federal financial regulatory agency's cybersecurity operations.

You will be the most senior responder on the team: running incidents involving advanced persistent threat (APT) and financially motivated (FIN) actors and cloud-based attacks, mentoring and reviewing the work of fellow analysts, and authoring the clear, defensible reports a demanding client expects. Between incidents the IR team dual-hats as Tier 3 escalation for the SOC. You will work directly with government staff, independently with some guidance, and share a weekly on-call rotation with the rest of the team.

• Respond to Incidents:
  Triage, investigate, contain, and remediate cybersecurity incidents, applying specific functional IR knowledge to drive them to resolution.
• Lead & Mentor:
  Run incidents end to end as the most senior analyst on the team; review work from junior analysts and give feedback that helps them grow.
• Respond to Advanced Actors:
  Handle and respond to APT and FIN threat actors and cloud-based threats (AWS), from initial detection through eradication and lessons learned.
• Work the SOC Stack:
  Investigate in Splunk (SIEM) and Microsoft Defender EDR, build and tune Splunk SOAR playbooks, pull AWS telemetry, map activity to MITRE ATT&CK, and follow NIST 800-61 incident handling.
• Prevent Recurrence:
  Recommend and implement process improvements with government staff; support auditors when IR processes are reviewed.
• Cover On-Call:
  Participate in the team's weekly after-hours on-call rotation (approximately one week in six).
• Report & Review:
  Author clear, robust incident reports in Archer (the system of record), track investigations and documentation in Git Hub, and perform QA on team member submissions before they go to the client.

• Seasoned Responder: 5+ years of hands-on incident response experience.
• Threat-Actor Experienced:
  You have handled an APT or FIN actor and responded to cloud-based threats (AWS or Azure/M365) in an IR capacity.
• EDR Fluent:
  Hands-on with Microsoft Defender EDR (preferred); strong Crowd Strike or Sentinel One responders are considered.
• SOC-Minded:
  Knowledge of SOC best practices and how a Tier 3 / IR team fits into them.
• Automation-Minded:
  You'd rather write a SOAR playbook or a Python parser than click through the same triage twice. Comfortable in Splunk SPL and at a Linux shell.
• Client-Ready:
  Comfortable working directly with clients and government staff - including a demanding one - with a professional demeanor.
• Strong Writer:
  You write clear incident reports and can QA others' work.
• Mentor:
  You have led or mentored junior analysts and reviewed their work.

• 5+ years of experience with incident response.
• Experience handling and responding to an APT or FIN actor and responding to cloud-based threats in an IR capacity.
• Experience working directly with clients in a professional demeanor.

• Experience with Microsoft Defender EDR (preferred) or an equivalent enterprise EDR such as Crowd Strike or Sentinel One.
• Knowledge of SOC best practices.
• Ability to work with government staff to suggest and implement process improvements, and to work with auditors to respond to…