incident response analyst

Sentar

<div>Sentar is dedicated to developing the critical talent that the connected world demands to create solutions to address the convergence of cybersecurity, intelligence, analytics, and systems engineering. We invite you to join the small business team where you can build, innovate, and secure your career.
Sentar is seeking a Tier 3 Incident Response Senior Analyst in Quantico, VA!
Role Description:
Sentar is hiring a Tier 3 Incident Response Senior Analyst who will be responsible for incident response activities throughout the Enterprise. This position will support an active government contract in Quantico, Virginia, providing defensive cyberspace operations and Cyber Security Service Provider (CSSP) functions. Additionally, this position will support the government's mission to deny, disrupt, and degrade adversaries&rsquo; abilities and attempts to disrupt, exploit and attack the information technology (IT) services provided to network users.
The selected applicant will perform a variety of activities including but not limited to:
<ul><li><ul><li>Collect and analyze network and host artifacts from a variety of sources to include logs, system images and packet captures to characterize activity, determine root cause, operational impact, and to enable rapid remediation and mitigation of cyber threats within the Enterprise Network through the investigation process.</li></ul></li>
<li>Manage and document cyber defense incidents from initial detection through final resolution.</li>
<li>Perform quality assurance on routine cyber incident reporting to ensure accuracy and compliance to policies and procedures.</li>
<li>Make recommendations for alert tuning and creation of new detection use cases from information gathered during response to new techniques observed on the network.</li>
<li>Mentor junior analysts and guide them through the investigation process as necessary.</li>
<li>Develop and refine curriculum for the supported customer's Incident Response Course.</li>
<li>Assist in instructing an Incident Response Course.</li>
<li>Conduct forensic analysis of device timeline, device memory, file systems, and pcap (Digital Forensics &amp; Incident Response - DRIR)</li>
</ul>
Schedule: On-site (no telework), M-F 8 X 5, on-call after hours and weekends approximately once every four weeks (occasional after hours phone call and possible recall to site &ndash; recall to site occurs very rarely). In extremis for priority mission requirements, any and all Tier 3 Incident Responders could be recalled &ndash; a rare occasion that we have not experienced since this contract began.
Qualifications:
Clearance Level: TS/SCI eligibility
Certifications:
<ul><li>IAT Level II certification</li>
<li>CSSP Incident Responder certification</li>
</ul>
Education/Experience: Associate's degree in a Computer Science, Information Technology, Information Systems, or Computer Engineering field; OR five (5) years of relatable work experience.
Benefits at Sentar:
Benefits at Sentar:
Our unique ownership model attracts top talent, giving employees the freedom to take initiative and drive meaningful improvements. In addition to cultivating a thriving and inclusive work environment, Sentar offers an extensive benefits package designed to support the well-being of employees and their families. Employee ownership is the foundation of our culture, promoting participation, teamwork, and accountability while ensuring long-term financial security and a commitment to excellence.
<ul><li>Voluntary Medical, Dental, Vision, with Health Savings or Flexible Spending Plan options</li>
<li>Voluntary Life, Critical Illness, Accident, and Long Term Care insurance options</li>
<li>Group Term Life, Short-Term and Long-Term Disability is provided by Sentar to all qualifying employees</li>
<li>Generous 401(k) match</li>
<li>Competitive PTO plan that graduates quickly with years of service</li>
<li>Other leave programs; holiday schedule along with bereavement, maternity, jury and military duty</li>
<li>Mental health awareness programs</li>
<li>Tuition reimbursement</li>
<li>Professional development reimbursement</li>
<li>Recognition and Awards programs</li>
</ul>
If you are not ready to apply for this position, submit your resume here to join our talent community. We'll keep you updated occasionally on new job opportunities.
Sentar is an Affirmative Action and Equal Opportunity Employer M/F/Vets/Persons with Disabilities
Our culture is one of inclusivity and support. Sentar is proudly an Equal Opportunity and VEVRAA Federal Contractor Employer M/F/Vets/Persons with Disabilities. Follow these links to learn more about your rights: EEO Is the Law Poster; EEO Is Law Supplement; and Pay Transparency.
We want you to build your career at Sentar, so if you are an individual with a disability and require a reasonable workplace accommodation applying for a job or at any point in the employment process, contact the Recruiting Manager at recruiting@sentar.com. Please indicate the specifics of the assistance needed. Thank you for considering Sentar in your employment search.
Build, Innovate, Secure Your Career at Sentar.</div>

Tier 3 Incident Response Senior Analyst

Naufar

<div>
 
 
 JOB PURPOSE:
 
 
 
 The Cyber Security Analyst creates a comprehensive program for establishing a Healthcare carrier-class Security Operation Center. S/he develop and maintain threat monitoring and security incident response procedures within Naufar. The analyst designs frameworks, procedures, and toolkits to enhance capabilities in professional forensic collection and digital evidence analysis. S/he also develop dashboards for reporting the organization's threat landscape, Awareness and security posture to senior management. This role is expert role with roles and responsibilities.
 
 
 
 
 
 
 Description
 
 
 <ul>
 <li>
 Develops and implements a cyber-security program to enhance Naufar capabilities regarding Cyber Attack incident monitoring, incidents response and intrusive and non-intrusive forensics capabilities.
 </li>
 <li>
 Develops and matures the service capabilities of the SOC, such as Forensics, Threat Management, Penetration Assessments, and Tool Management.
 </li>
 <li>
 Develops, Contributes and maintains of the cyber security strategy.
 </li>
 <li>
 Implements, configures and maintains security control and process, to ensure threat indicators are rated by severity and responded to in a manner consistent with the threat.
 </li>
 <li>
 Identifies deficiencies and recommends corrective action to strengthen information security control and decrease the risk of data breach.
 </li>
 <li>
 Maintains and updates standard operation policies and procedures for incident response plans, e-discovery processing, remote acquisition/analysis tools, collections and forensic analysis techniques.
 </li>
 <li>
 Maintains industry standard tools and processes used for forensic analysis and eDiscovery collections and processes.
 </li>
 <li>
 Monitors security alerts for potential events/incidents as well as trending and historical analysis and ensuring all incident reports are complete and written within standard operations and ensures ticket audits and reviews are completed
 </li>
 <li>
 Utilizes leading forensic software to identify, collect, preserve and analyze electronic data from laptops, desktops, servers, email archives, infrastructure logs, network file servers, backup tapes, cell phones, PDAs and a wide variety of other media devices.
 </li>
 <li>
 Manages requests for electronic data and digital forensic investigations that relate to Litigation, Regulatory matters, Compliance, and Employee Investigations.
 </li>
 <li>
 Performs cybersecurity incident analysis and assist with incident response, including analysis of network content and metadata for investigations or malware detection and identifies the cause and extent of a breach.
 </li>
 <li>
 Serves as a subject matter expert and technical advisor in matters relating to the proper collection, preservation, packaging, and submission of digital and multimedia evidence.
 </li>
 <li>
 Participates in incident electronic evidence collection activities in major field investigations. Ensures evidence handling requirements are met.
 </li>
 <li>
 Performs post-incident report according to standard operations.
 </li>
 <li>
 Analyzes the tools and methodology used for investigation and accordingly presents improvements in control and corrective actions if any.
 </li>
 <li>
 Escalates and works with senior management on resolutions to overdue security items or any negative trends identified.
 </li>
 <li>
 Develops focused reporting and briefings for advanced cyber threats.
 </li>
 <li>
 Conducts studies and research for improving forensic analyses, scientific methods, and resolving forensic examination problems.
 </li>
 <li>
 Creates detailed, professional documentation and reports, including performance metrics and presentations for management.
 </li>
 <li>
 Leads or contributes to key projects related to corporate threat monitoring, forensics or information security initiatives.
 </li>
 <li>
 Facilitates group risk assessment activities and identifies any security-related process improvement opportunities.
 </li>
 <li>
 Monitors and performs trending on root cause analysis activities within assigned group and participates as needed to resolve clinical systems security related incidents.
 </li>
 <li>
 Assists on monitoring compliance with information security policies, standards and ENTERPRISE-WIDE strategy and facilitates threat and vulnerability evaluations on a regular basis. Measures and reports on the effectiveness of information security controls.
 </li>
 <li>
 Supports the security initiatives, corrective and preventative actions, and security measures by ensuring timely updates and escalating concerns and non-compliances.
 </li>
 <li>
 Understands and maintains the appropriate knowledge of Security Technologies, (Firewall, Anti-Virus, Email and Web Encryption, HIPS, NIPS, SIEM, WAF, DLP), security procedures, and services within Naufar IT Security as well as ensures all tools are functioning properly.
 </li>
 <li>
 Keeps up to date on changes to significant regulatory and applicable standards issued by internal or external agencies, as applicable to the Naufar&rsquo;s domain.
 </li>
 <li>
 Adheres to Naufar&rsquo;s standards as they appear in the Code of Conduct and Conflict of Interest policies
 </li>
 </ul>
 
 
 
 
 
 Academic Qualifications:
 
 
 <ul>
 <li>
 Bachelor&rsquo;s degree &ndash; IT - Mandate
 </li>
 <li>
 Master&rsquo;s degree &ndash; Cybersecurity - Desired
 </li>
 </ul>
 
 
 
 
 
 Experience Requirements:
 
 
 <ul>
 <li>
 8+ years of experience working as a security analyst or SME within a Security Operations Center with exposure to cyber security collection, analysis and threats management, investigation and digital forensics.
 </li>
 <li>
 Demonstrated experience in threat detection and analysis, incident response, and reporting.
 </li>
 <li>
 Demonstrated experience with incident response, deep dive forensics, insider threat, cyber and data exfiltration incidents.
 </li>
 <li>
 Demonstrated experience conducting assessments, digital forensic investigations, vulnerability management and incident response.
 </li>
 <li>
 Demonstrated experience with current cyber threats and the associated tactics, techniques, and procedures used to infiltrate computer networks.
 </li>
 <li>
 Demonstrated experience with SEIM products in the detection, response, mitigation, and/or reporting of cyber threats
 </li>
 <li>
 Demonstrated experience in the use of forensic tools (e.g. FTK, Encase, Forensic Toolkit, X-Ways, Linux based tools, etc.)
 </li>
 <li>
 Experienced with (or equivalent) the following regulations and frameworks: PCI, HIPAA, and ISO/IEC 2700x
 </li>
 </ul>
</div>

Cyber Security Analyst

Innovative Solutions

<div><h3 class="jobSectionHeader">Company Description</h3>
Innovative Solutions (IS) is a leading pure-player Cybersecurity company in the GCC, established in 2003 and headquartered in Riyadh, with operations in Al Khobar, Jeddah, Dubai, and Abu Dhabi. Our mission is to &lsquo;Bring Trust to Cyberspace&rsquo; and ensure &lsquo;Your Business, Secured&rsquo;. We offer comprehensive Cybersecurity Solutions and Services that include Advisory Services, Technical Assurance, Solution Deployment, Professional Services, and Managed Security Services.<h3 class="jobSectionHeader">
Role Description</h3>
The SOC Analyst - Level 2 position at Innovative Solutions plays a pivotal role in our Security Operations Center (SOC). In this capacity, you will be tasked with monitoring security events, analyzing incidents, and implementing advanced response strategies to protect our clients' networks. Your expertise will guide incident response activities, enabling the identification and remediation of security threats effectively.<h3 class="jobSectionHeader">
Key Responsibilities</h3><ul>
<li>Conduct thorough analysis and investigation of security alerts and incidents.</li>
<li>Coordinate response actions and lead efforts on high-priority security incidents.</li>
<li>Utilize SIEM tools for threat detection and incident management.</li>
<li>Assist in the development of detection rules and incident response playbooks.</li>
<li>Provide mentorship and training to SOC Level 1 analysts.</li>
<li>Continuously evaluate and improve SOC processes and tools.</li>
<li>Collaborate with internal stakeholders and provide security recommendations based on analysis.</li>
</ul>Requirements<ul><li>
Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.</li></ul><ul>
<li>A minimum of 2-4 years of experience in a SOC analyst role or similar position.</li>
<li>In-depth understanding of security technologies including SIEM, IDS/IPS, endpoint detection, and response tools.</li>
<li>Certifications such as Security+, CEH, or similar cybersecurity qualifications are advantageous.</li>
</ul>
Benefits<ul>
<li>Comprehensive training and development programs.</li>
<li>Opportunity for career growth and advancement.</li>
<li>Friendly and supportive work environment.</li></ul></div>

Security Operation Center Analyst - L2

Trust Arabia Administrative Services & Consultancy

About the RoleWe are seeking an experienced Security Operations Center (SOC) Analyst. The ideal candidate will have strong analytical skills, a proactive mindset, and proven experience in detecting, analyzing, and responding to cybersecurity incidents. This role combines strategic thinking with hands-on technical expertise to ensure our security defenses remain resilient against evolving threats.Key Responsibilities<ul><li>Monitor and analyze security alerts from SIEM, IDS/IPS, firewalls, and endpoint protection tools.</li><li>Investigate, triage, and respond to security incidents, identifying root causes and implementing corrective actions.</li><li>Conduct proactive threat hunting and vulnerability assessments.</li><li>Develop and maintain incident response procedures and playbooks.</li><li>Collaborate with IT and network teams to strengthen overall security posture.</li><li>Prepare detailed reports and provide recommendations to senior management on emerging threats and mitigation strategies.</li></ul>Mandatory Requirements<ul><li>Experience: 4&ndash;7 years in a SOC Analyst or related cybersecurity role.</li><li>Language: Fluent in English (written and spoken).</li><li>Availability: Ready to join by January 26.</li><li>License: Valid driving license.</li><li>Strong hands-on experience with systems and security tools (configuration, troubleshooting, optimization).</li><li>Solid understanding of security frameworks such as MITRE ATT&amp;CK, NIST, and ISO 27001.</li><li>Proficiency with SIEM platforms like Microsoft Sentinel, Splunk, or IBM QRadar.</li></ul>Preferred Qualifications (Plus Points)<ul><li>Arabic language proficiency.</li><li>Experience in the Oil &amp; Gas sector, especially with industrial control systems (ICS) or OT security.</li><li>Relevant certifications such as GCIA, GCIH, CEH, CompTIA Security+, or CISSP.</li></ul>Soft Skills<ul><li>Excellent communication and reporting abilities.</li><li>Strong analytical and problem-solving mindset.</li><li>Ability to perform effectively under pressure in incident response scenarios.</li><li>Team-oriented, adaptable, and committed to continuous improvement.</li></ul>Job Type: Full-time

SOC Analyst

Paramount Assure

<div> L2 SOC Analyst Compromise Assessment &amp; Incident Response (with SIEM Admin Knowledge) Role Overview: We are seeking a skilled L2 Security Analyst to support our MSSP operations team. The ideal candidate will possess a solid background in incident response and compromise assessment, as well as administration skills across various security platforms. You will work with enterprise clients to identify threats, perform in-depth investigations, and ensure platform reliability. Location: Onsite Key Responsibilities: Security Monitoring &amp; Incident Handling Analyze alerts from SIEM/EDR and perform triage to validate incidents. Provide containment and eradication support in real-time. Correlate logs and conduct root cause analysis using various telemetry sources. Compromise Assessment &amp; Generate IR reports, dashboards, and executive summaries. Lead endpoint and network-based compromise assessments for clients. Administrative &amp; Platform Support and maintain the health of SIEM, EDR, and firewall integrations. Troubleshoot ingestion issues and optimize detection logic. Ensure secure onboarding of log sources via APIs or agent-based collectors. Threat Intel &amp; Document IOCs and provide actionable recommendations. Requirements: Technical Expertise, 5 7 years of experience in SOC/IR roles. Strong command of MITRE ATT&amp;CK, Windows/Linux logs, and AD attacks. Proficient with SIEMs (QRadar, ELK, Sentinel), and forensic/packet tools. Familiarity with scripting (PowerShell/Python). Administrative Knowledge &amp; Experience managing SIEM infrastructure. Understanding of firewall policies, email security, and cloud logs. Ability to configure connectors, fine-tune rules, and automate integrations.</div>

SOC L2

NIKE

<div>WHO WILL YOU WORK WITH
This role reports into the Cybersecurity Incident Response team within Corporate Information Security.
WHO ARE WE LOOKING FOR
We&rsquo;re looking for a Senior Cyber Security Analyst. This role on the team will include leveraging knowledge of industry best practices, good judgment and problem-solving skills to execute Nike security operations. Being on Nike&rsquo;s front lines of defense, the Senior Cyber Defense Analyst is adept at making good decisions under pressure and be able to quick adapt to any security challenge. This individual also pays attention to detail and is disciplined in documenting process and procedures. The Senior Cyber Defense Analyst will also be Shift Lead (2nd tier support) for all requests coming into the department making sure departmental SLAs are met. The ideal candidate believes in operational excellence, continual process improvement and customer service.
WHAT WILL YOU WORK ON
If this is you, you&rsquo;ll be working with the Cybersecurity Incident Response team and performing these key tasks:<ul><li>
Perform log analysis and correlate disparate datasets to identify abnormal behavior.</li><li>
Respond to security events, driving issues to closure, and engaging all appropriate resources.</li><li>
Document Security process and procedures.</li><li>
Support service request in-take process and communicate back to requestors promptly</li><li>
Provide enforcement of security policies, standards and procedures</li><li>
Staying current on security technologies, trends, standards and best practices</li><li>
Continually update skills</li><li>
Other duties and responsibilities as assigned</li></ul>
WHAT YOU BRING
<ul><li>Bachelor&rsquo;s degree in computer science or related field, or equivalent work experience</li><li>
Five years of information technology experience with three years in an information security-related role</li><li>
Solid knowledge of information security principles and practices</li><li>
Minimum five years of security monitoring experience and incident response activities; preferably within a professional services firm or similar environment</li><li>
Strong knowledge of incident response and crisis management with the ability to identify both tactical and strategic solutions using strong verbal and written communication skills</li><li>
Cloud security knowledge and skills; securing cloud environments as well as detecting and responding to cyber security incidents in the cloud</li><li>
Log (network, security, access, OS, application, etc.) analysis skills and experience in relation to identifying and investigating security incidents</li><li>
Proficiency with Linux/UNIX, Windows, and/or Mac OSX</li><li>
Understanding of application security and dev-sec-ops</li><li>
Coding/scripting experience (PowerShell, Python, Ruby, Java, VB Scripting etc.)</li><li>
Malware analysis, virus exploitation and mitigation techniques experience.</li><li>
Comfortable with interfacing with other internal or external organizations regarding security policy and standards violations, security controls failure and incident response situations</li><li>
Understanding of network, desktop and server technologies, including experience with network intrusion methods, network containment, segregation techniques and technologies such as Intrusion Detection Systems (IDS) and Intrusion Protection Systems (IPS)</li><li>
The ability to learn and apply new concepts quickly</li><li>
Resolves problems independently and/or through a support team.</li><li>
Ability to balance and prioritize work</li><li>
Must be trustworthy in keeping sensitive data confidential</li></ul>
One or more of the following professional certifications preferred, but not required:<ul><li>
Certified Information Security Professional (CISSP)Global Information Assurance Certifications (GIAC)</li><li>
Speaking a language in addition to English preferred, but not required</li></ul></div>

Senior Cyber Defense Analyst, ITC

Accenture

Project Role : Security Delivery Practitioner 
Project Role Description : Assist in defining requirements, designing and building security components, and testing efforts.
 
Must have skills : Security Information and Event Management (SIEM) 
Good to have skills : NA 
Minimum 3 year(s) of experience is required 
Educational Qualification : 15 years full time education 
 
Summary: The QRadar L2 Security Analyst plays a critical role in analyzing, investigating, and responding to security incidents. This role involves advanced use of IBM QRadar SIEM for threat detection, offense tuning, and incident response coordination. Roles &amp; Responsibilities: &bull; Analyze and investigate escalated security incidents from L1 analysts &bull; Correlate events across multiple log sources to identify patterns and threats &bull; Fine-tune QRadar correlation rules, offenses, and custom use cases &bull; Develop and maintain dashboards, reports, and offense workflows &bull; Perform threat hunting and proactive analysis using QRadar and threat intelligence feeds &bull; Coordinate with incident response teams for containment and remediation &bull; Conduct root cause analysis and document findings in incident reports &bull; Mentor and guide L1 analysts on triage and escalation procedures &bull; Participate in periodic audits, compliance checks, and SOC maturity assessments Required Skills &amp; Experience &bull; 2&ndash;5 years of experience in SOC or cybersecurity operations &bull; Strong hands-on experience with IBM QRadar SIEM (rule creation, offense tuning, log source integration) &bull; Solid understanding of TCP/IP, network protocols, and common attack vectors &bull; Familiarity with MITRE ATT&amp;CK framework, threat intelligence platforms, and IOC analysis &bull; Experience with scripting (Python, Bash) for automation and log parsing &bull; Knowledge of incident response lifecycle and forensic investigation techniques &bull; Experience with ticketing and workflow tools (e.g., ServiceNow, JIRA) Professional &amp; Technical Skills: &bull; Bachelor&rsquo;s degree in Computer Science, Information Security, or related field &bull; Preferred certifications: o IBM QRadar Certified Analyst o CompTIA Security+ o CEH / CHFI / GCIA / GCIH Additional Information: &bull; Exposure to SOAR platforms and integration with QRadar &bull; Experience in multi-tenant or MSSP environments &bull; Knowledge of compliance frameworks (ISO 27001, NIST, GDPR)
 
15 years full time education

Security Delivery Practitioner

Search 6808+ Incident response analyst jobs near you this November. New roles added regularly across leading industries. Apply today.