FREE ACCESS
5,000–10,000 jobs/day
See all jobs on Scoutfield
Search thousands of fresh jobs every day.
Discover
- Fresh listings
- Fast filters
- No subscription required
Create a free account and start exploring right away.
Core Competencies
Role fitCore Competencies
Use this summary to align your resume positioning with the role.
Demonstrates extensive experience in incident response, particularly with APT and FIN threat actors, while effectively utilizing tools like Splunk and Microsoft Defender EDR. Capable of leading investigations, authoring detailed reports, and implementing process improvements in collaboration with government staff.
Highest-signal resume keywords
Incident Response ExperienceSplunk SIEM and SOARMicrosoft Defender EDRSenior-Level Incident Response CertificationAWS Threat Response
ATS Keywords
Tailor your resumeApplicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard Skills
Incident ResponseThreat HuntingScripting with PythonSPL for AutomationMapping to MITRE ATT&CKNIST 800-61 ComplianceAWS Cloud SecurityArcher GRCGitHub for DocumentationQuality Assurance Review
Soft Skills
Professional Client InteractionFeedback and Mentorship
Tools & Technologies
SplunkMicrosoft Defender EDRAWSArcherGitHub
Certifications & Qualifications
GIAC GCIHGCFAGCFRGNFAGREMEC-Council ECIH
Industry Keywords
CybersecurityIncident HandlingAPT ThreatsFIN ThreatsSOC Best PracticesFederal Financial Regulatory AgencyProcess ImprovementSecurity InvestigationPublic Trust ClearanceU.S. Citizenship
Tech Stack
Tools & technologiesAWSAzureCloudCyber SecurityPythonSplunk
About the role
Key responsibilities & impact- Triage, investigate, contain, and remediate cybersecurity incidents through resolution
- Lead incidents end to end as the most senior analyst on the team
- Review junior analysts' work and provide feedback for growth
- Respond to APT and FIN threat actors and cloud-based AWS threats from detection through eradication and lessons learned
- Investigate in Splunk SIEM and Microsoft Defender EDR
- Build and tune Splunk SOAR playbooks
- Pull AWS telemetry and map activity to MITRE ATT&CK
- Follow NIST 800-61 incident handling practices
- Recommend and implement process improvements with government staff
- Support auditors during reviews of IR processes
- Participate in a weekly after-hours on-call rotation, approximately one week in six
- Author incident reports in Archer
- Track investigations and documentation in GitHub
- Perform QA on team member submissions before client delivery
- Work directly with government staff and clients as part of a federal financial regulatory agency's cybersecurity operations
Requirements
What you’ll need- 5+ years of hands-on incident response experience
- Experience handling and responding to an APT or FIN actor
- Experience responding to cloud-based threats in an IR capacity, including AWS or Azure/M365
- Experience working directly with clients in a professional demeanor
- Experience with Microsoft Defender EDR (preferred) or an equivalent enterprise EDR such as CrowdStrike or SentinelOne
- Knowledge of SOC best practices
- Ability to work with government staff to suggest and implement process improvements
- Ability to work with auditors to respond to and resolve identified issues in IR processes
- Ability to author clear and robust reports and review and ensure QA of team member submissions
- Senior-level Incident Response certification: GIAC GCIH, GCFA, GCFR, GNFA, GREM, or EC-Council ECIH
- Ability to participate in a weekly after-hours on-call rotation
- Bachelor's Degree required
- Public Trust / Suitability clearance; applicants selected will be subject to a security investigation
- Must be a U.S. Citizen
- Ability to work within core hours of approximately 7:30 AM–4:30 PM US Eastern Time, Monday through Friday
- Experience with Splunk (SIEM) and Splunk SOAR, including playbook development
- Experience with GitHub for investigation tracking and documentation
- Experience with Archer (RSA/Archer GRC) as an incident system of record
- Experience responding to incidents in AWS, including CloudTrail, GuardDuty, and IAM/credential abuse
- Experience mapping activity to MITRE ATT&CK and following NIST 800-61
- Scripting for automation and triage using Python and SPL
- Threat hunting experience
- Ability to review work from junior analysts and provide feedback for growth
Benefits
Comp & perks- Medical Insurance
- Dental Insurance
- Vision Insurance
- Life Insurance
- Short Term & Long Term Disability
- 401k Retirement Savings Plan with Company Match
- Paid Holidays
- Paid Time Off (PTO)
- Tuition and Professional Development Assistance