Cyber Security Incident Response Analysis II - Digital Forensics and Incident Response

This position supports the cybersecurity program at the U.S. Department of Energy (DOE) Hanford Site in Richland, Washington. The Analyst detects, investigates, and responds to cybersecurity incidents across a FISMA Moderate IT enterprise and supporting industrial control system (ICS) / operational technology (OT) environments governed by DOE Order 205.1C and NIST SP 800-53 Rev. 5. Working with increasing independence under the guidance of senior analysts, the Analyst handles assigned incidents from triage through closure, performs host, memory, network, and cloud forensic analysis, and contributes to detection content, playbooks, and post-incident improvements.

This role suits analysts with foundational DFIR experience who are ready to take ownership of investigations of moderate complexity.

• Monitor, triage, and analyze security alerts and events from SIEM, EDR, NDR, SOAR, email security, and other enterprise security platforms; validate findings and escalate in accordance with established procedures.
• Act as incident handler for assigned incidents from detection through closure, including scoping, containment, eradication, and recovery recommendations, in alignment with NIST SP 800-61 Rev. 3, the CISA federal incident response playbook, and the site incident response plan.
• Conduct forensic acquisition and analysis of endpoints, servers, memory, logs, and network traffic (disk imaging, live triage collection, memory analysis, timeline and artifact analysis) to determine root cause, scope, and impact.
• Investigate account compromise, business email compromise, and data exposure using identity and cloud audit sources (e.g., Microsoft 365 Unified Audit Log, Entra
  -in and audit logs).
• Preserve evidence and maintain chain of custody in accordance with NIST SP 800-86 and site procedures, supporting potential referral to the DOE Office of Inspector General, law enforcement, or legal counsel.
• Document incident activity in the case management system (e.g., Service Now); prepare incident reports, timelines, and root cause analyses; and support incident reporting to DOE, including the Integrated Joint Cybersecurity Coordination Center (iJC3), within required timelines under DOE O 205.1C.
• Conduct hypothesis-driven threat hunts informed by threat intelligence and MITRE ATT&CK (including ATT&CK for ICs), including targeted hunts in response to CISA Emergency Directives, Binding Operational Directives, and DOE threat notifications.
• Develop and tune detection content and indicators of compromise (IOCs), such as SPL/KQL queries and Sigma and YARA rules, based on investigation findings and emerging threats.
• Coordinate with IC/OT engineering staff during incidents affecting operational environments, using non-intrusive collection methods that protect safety and operational availability.
• Monitor threat intelligence from DOE, CISA, and other sources; distribute threat advisories and incident summaries to customers and leadership.
• Contribute to incident response playbooks, standard operating procedures, and the incident response plan; participate in tabletop and functional exercises and after-action reviews, and track corrective actions to closure, including POA&M entries where applicable.
• Support cyber security audits, assessments, and data calls related to incident response, audit logging (including OMB M-21-31 event logging requirements), and continuous monitoring.
• Support operation and maintenance of forensic and incident response tools.
• Share knowledge with and assist in training Level I analysts and interns.
• Perform other duties as appropriate and as assigned.

• Two (2) or more years of experience in cyber security, including hands-on incident response, digital forensics, or security operations center (SOC) experience
• Working knowledge of federal incident response and forensics requirements, including NIST SP 800-61 Rev. 3, NIST SP 800-86, NIST SP 800-53 Rev. 5 (IR and AU control families), and DOE O 205.1C.
• Hands-on experience with forensic and triage tools (e.g., Magnet AXIOM, FTK, EnCase).
• Experience with SIEM, EDR, and network analysis tools (e.g., Splunk, Microsoft Sentinel, Crowd Strike Falcon, Microsoft Defender for Endpoint, Zeek, Wireshark).
• Working knowledge of Windows and Linux internals and forensic artifacts (registry, event logs, file systems, persistence mechanisms), Active Directory, network protocols, and common malware behavior.
• Ability to map…