Incident Response Analyst

Leidos is seeking an experienced Incident Response Analyst to support the Defense Manpower Data Center (DMDC)   CyberPRIMES   program . Leidos is a major partner on the contract and will provide a substantial   portion   of the cybersecurity workforce supporting the Defense Human Resources Activity (DHRA) and DMDC.   The Incident Response Analyst will investigate and respond to cybersecurity events and incidents affecting DHRA systems and networks. This position supports the full incident-response lifecycle—from detection and analysis through containment, eradication, recovery, and post-incident activities—and works closely with Security Operations Center analysts, Cybersecurity Service Providers, system owners, and technical teams during active cybersecurity incidents.   Work Locations:   Mark Center, Alexandria, Virginia Department of Defense Center – Monterey Bay, Seaside, California Clearance: Active Secret security clearance required at time of consideration. U.S. Citizen is a must. Mission Environment   DMDC supports the Defense Human Resources Activity within the Office of the Under Secretary of Defense for Personnel and Readiness (OUSD(P&R)) and maintains the Department of Defense’s largest and most comprehensive central repository of personnel, manpower, casualty, pay, entitlement, personnel security, identity, readiness, training, and related data.   The DHRA Information Technology (IT) environment includes approximately 15,000 network and endpoint devices supporting more than 600 Government-Off-The-Shelf (GOTS) applications and approximately 100 Risk Management Framework (RMF) authorization boundaries managed through the Enterprise Mission Assurance Support Service ( eMASS ).   Incident-response operations support both the Non-classified Internet Protocol Router Network (NIPRNet) and Secret Internet Protocol Router Network (SIPRNet) environments. Analysts must be able to move quickly from security-event identification into investigation and coordinated response while   maintaining   accurate   records, preserving evidence, and keeping Government stakeholders informed.

Support preparation, detection, analysis, containment, eradication, recovery, and post-incident activities for cybersecurity events and incidents.   Investigate cybersecurity incidents affecting NIPRNet and SIPRNet environments.   Perform proactive security monitoring and analysis to   identify   potential intrusion attempts and other malicious activity.   Analyze security information from Security Information and Event Management (SIEM) platforms, endpoint-security capabilities, firewalls, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), web-security systems, antispam capabilities, malware-prevention systems, and related enforcement technologies.   Recognize potential intrusion attempts, malicious activity, or other cybersecurity conditions requiring immediate investigation or mitigation.   Assess cybersecurity events to   determine   scope, potential impact, affected systems, and   required   response actions.   Support containment and mitigation of active cybersecurity threats   in accordance with   approved Government procedures.   Coordinate eradication and recovery activities with system owners, administrators, network personnel, cybersecurity teams, and other technical stakeholders.   Collect and preserve technical evidence associated with cybersecurity events and incidents.   Maintain complete and   accurate   incident records, timelines, supporting evidence, investigative findings, response actions, and status information.   Develop and contribute to required cybersecurity event and incident reporting.   Coordinate incident-response activities with Security Operations Center analysts, Cybersecurity Service Providers (CSSPs), system owners, technical teams, and Government stakeholders.   Support escalation of significant cybersecurity events and