Senior Cyber Defense Analyst, Incident Responder

Amentum

. Provide oversight and guidance for the MDA CSSP-CERT Cyber Defense and Incident Response program .

Posted 9/23/2026full-timeUnited StatesSenior💰 $145,000 - $152,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in Cyber Defense and Incident Response, including oversight of cybersecurity operations, incident analysis, and mentoring of junior analysts. Proficient in utilizing cybersecurity tools and frameworks to enhance threat detection and response capabilities.

Highest-signal resume keywords

Cyber Defense OperationsIncident Response ManagementCybersecurity CertificationsSecurity Analysis in WAN/LAN EnvironmentsMentoring and Training Personnel

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident ResponseCyber Threat IntelligenceData AnalysisPenetration TestingDigital ForensicsPython ProgrammingPowerShell ScriptingBash ScriptingKQL ProficiencySecurity Compliance Analysis

Soft Skills

Multi-taskingPrioritizationLeadershipCommunicationTeam Collaboration

Tools & Technologies

SIEM PlatformsEDR ToolsSOAR PlatformsFirewallsIDS/IPSNetwork Security ManagerACASNessusWindows Operating SystemLinux Operating System

Certifications & Qualifications

CBROPSCFRCySA+GCFAGCIAGICSPOSCPPNPTGPENGCIH

Industry Keywords

CybersecurityIncident ResponseDefensive Cyber OperationsDoD Security OperationsThreat DetectionVulnerability AssessmentChain of CustodyCyber Incident InvestigationIntelligence CycleCSSP-CERT

Tech Stack

Tools & technologies

Cyber SecurityFirewallsLinuxPython

About the role

Key responsibilities & impact

Provide oversight and guidance for the MDA CSSP-CERT Cyber Defense and Incident Response program
Serve as primary point of contact for Junior and Mid Cyber Defense Analysts
Perform Defensive Cyber Operations and CSSP duties outlined in Evaluator Scoring Metrics
Perform proactive and reactive cybersecurity duties on customer networks
Conduct preliminary analysis, identification, and response to cyber incidents in accordance with CJCSM 6510.01B
Lead event and incident investigations from start to conclusion, including data gathering, analysis, and reporting
Document incident response steps and preserve incident artifacts, evidence, and chain of custody
Analyze correlated asset, threat, and vulnerability data against adversary exploits and techniques
Support training plans by instructing, evaluating, and mentoring junior and mid-level analysts and responders
Develop, establish, review, and update DCO procedures, processes, manuals, and documentation
Use cyber threat intelligence to identify indicators of compromise and develop SIEM content/signatures
Coordinate configurations, rules, and signatures for cybersecurity toolsets with CSSP-CERT subscribers
Coordinate notification, investigation, and remediation of security logging and CSSP-CERT alignment discrepancies
Provide standardized and targeted training for CSSP-CERT subscriber cyber defense and incident response programs
Review, analyze, document, and report ongoing intrusions and cybersecurity incidents
Support insider threat, law enforcement, and counterintelligence agencies during cyber incidents and investigations
Work rotating shifts in a 24/7 operational environment
Travel as required

Requirements

What you’ll need

6 or more years of combined experience performing the full life-cycle of incident response and enterprise-level monitoring and analysis of events
2 or more years of experience in management or leadership in a team environment
One of the following certifications: CBROPS, CFR, CySA+, GCFA, GCIA, or GICSP
Active DoW Top Secret with SCI Eligibility
Experience with most MS Office applications, including Word, Excel, PowerPoint, and Visio
Ability to multi-task and prioritize projects and assignments in a dynamic work environment
Willingness to travel 25% of the time
Willingness to work rotating shifts in a 24/7 operational environment and respond quickly to emergencies
Master's degree or higher in Cybersecurity, Computer Science, or related field (desired)
One or more advanced cybersecurity certifications (desired): OSCP, PNPT, GPEN, GCFA, GCFE, GCIH, CHFI, or GCTI
Experience with security analysis and solutions in WAN/LAN environments, including routers, switches, network devices, and operating systems such as Windows and Linux (desired)
Experience with SOC/DCO tools including firewalls, IDS/IPS, Network Security Manager, forward proxy, and spam firewall (desired)
Experience analyzing ACAS/Nessus compliance scans (desired)
Experience analyzing network and host-based threats, with ESS preferred (desired)
Ability to mentor and train personnel (desired)
Familiarity with DoD Security Operations Centers and DCO/CSSP security policies and procedures (desired)
Demonstrable experience in penetration testing, red teaming, or exploit development (desired)
Experience with advanced digital forensics, including host-based and memory analysis (desired)
Proficiency in Python, PowerShell, Bash, or KQL for automation and large-dataset parsing (desired)
Familiarity with the intelligence cycle and its application to cybersecurity operations (desired)
Experience with EDR, SIEM, and SOAR platforms (desired)
Familiarity with AI and LLM applications in cybersecurity (desired)
Resume submitted in month and year format is required for consideration

Benefits

Comp & perks

Health, dental, and vision insurance
Paid time off and holidays
Retirement benefits, including 401(k) matching
Educational reimbursement
Parental leave
Employee stock purchase plan
Tax-saving options
Disability and life insurance
Pet insurance