Cyber Incident Response Tier III Analyst Security Clearance

Position: Cyber Incident Response Tier III Analyst with Security Clearance
Description Ping Wind is seeking a Cyber Incident Response Tier III Analyst to support our VA customer at Hines, IL Martinsburg, WV, or Austin, TX.

Location:

On-site in Hines, IL Martinsburg, WV, or Austin, TX Required Clearance:
Ability to obtain Tier 4 / High Risk Background Investigation

Certifications:

Must currently have or be willing to obtain one of the following certifications (or equivalent):
• GIAC Certified Incident Handler
• EC-Council's Certified Incident Handler (ECIH)
• GIAC Certified Incident Handler (GCIH)
• Incident Handling & Response Professional (IHRP)
• Certified Computer Security Incident Handler (CSIH)
• Certified Incident Handling Engineer (CIHE)
• EC-Council's Certified Ethical Hacker Required Education
• Bachelor's degree in computer science, Cybersecurity, Information Technology, or a related field (or equivalent work experience)

Required Experience:

• 5+ years of experience supporting incident response in an enterprise-level Security Operations Center (SOC) Responsibilities
• In-depth forensics and root cause analysis for alerts and incidents
• Handling Tier 2 ticket escalations by performing forensic root cause analysis and delivering actionable remediation recommendations and or appropriate next steps.
• Perform post incident analysis to ensure accurate and detailed documentation of incident response activities, including analysis, actions taken, and lessons learned.
• Work with Watch Officers and Team Leads on a bridge to function as SME for major incidents.
• Updating playbooks based on findings of the incident trends and outcomes of auditing tasks.
• Develop and operationalize advanced security analytic use cases to detect and respond to sophisticated cyber threats in real-time
• Create dashboards/reports based on these trends or searches to provide clarity of information being defined.
• Interface with the Cyber Detection Analytics (CDA) Team to recommend tuning based on findings.
• Support mentoring and training of junior analysts on alerts, playbooks, and tools.
• Stay informed of latest cybersecurity threats and best practices.
• Perform real-time monitoring and triage of security alerts in Cybersecurity toolsets including SIEM, and EDR
• Make accurate determination of what alerts are false positives or require further investigation and prioritization
• Lead and actively participate in the investigation, analysis, and resolution of cybersecurity incidents. Analyze attack patterns, determine the root cause, and recommend appropriate remediation measures to prevent future occurrences
• Ensure accurate and detailed documentation of incident response activities, including analysis, actions taken, and lessons learned. Collaborate with knowledge management teams to maintain up-to-date incident response playbooks
• Collaborate effectively with cross-functional teams, including forensics, threat intelligence, IT, and network administrators. Clearly communicate technical information and incident-related updates to management and stakeholders
• Identify and action opportunities for tuning alerts to make the incident response team more efficient
• Monitor the performance of security analytics and automation processes regularly, identifying areas for improvement and taking proactive measures to enhance their efficacy
• Leverage Security Orchestration, Automation, and Response (SOAR) platforms to streamline and automate incident response processes, including enrichment, containment, and remediation actions
• Support the mentoring and training of more junior IR staff
• Stay informed about the latest cybersecurity threats, trends, and best practices. Actively participate in cybersecurity exercises, drills, and simulations to improve incident response capabilities Requirements
• Work 100% on-site Tuesday through Saturday from 3:00 PM to 11:00 PM
• A deep understanding of cybersecurity principles, incident response methodologies, and a proactive mindset to ensure our SOC operates effectively in a high-pressure environment
• Strong experience with security technologies, including SIEM, IDS/IPS, EDR, and network monitoring tools
• Experience with enterprise ticketing systems…