Sr. Incident Response Analyst at Cherokee Federal

, , United States -

Full Time

Start Date

Immediate

Expiry Date

08 Oct, 26

Salary

170000.0

Posted On

10 Jul, 26

Experience

5 year(s) or above

Remote Job

Yes

Telecommute

Yes

Sponsor Visa

Skills

Incident Response, Threat Hunting, Detection Engineering, SIEM, EDR/XDR, Cloud Security, Root Cause Analysis, Log Analysis, Malware Triage, MITRE ATT&CK, Digital Forensics, Python, PowerShell, Splunk, Microsoft Sentinel, Network Security

Industry

Business Consulting and Services

Description

Senior Incident Response Analyst The Senior Incident Response Analyst is a hands-on cybersecurity professional responsible for identifying, investigating, containing, and supporting the remediation of cybersecurity incidents across enterprise environments. Working closely with Security Operations, Detection Engineering, Cloud Security, and Vulnerability Management teams, this role helps protect mission-critical systems through rapid incident response, threat analysis, proactive threat hunting, and continuous process improvement. The successful candidate will play a key role in strengthening the organization’s cyber defense capabilities by improving incident response processes, supporting detection engineering efforts, participating in threat hunting activities, and helping mature overall security operations. Compensation & Benefits: Estimated Starting Salary Range for Senior Incident Response Analyst: $160,000–$170,000 Pay commensurate with experience. Full-time benefits include Medical, Dental, Vision, 401K, and other possible benefits as provided. Benefits are subject to change with or without notice. Senior Incident Response Analyst Responsibilities Include: * Investigate, triage, analyze, contain, eradicate, and support recovery activities for cybersecurity incidents across enterprise and cloud environments. * Perform detailed analysis of security events generated by SIEM, EDR/XDR, IDS/IPS, cloud-native security tools, and endpoint technologies. * Collaborate with Security Operations and Splunk Detection Engineering teams to improve detection content, tune alerts, reduce false positives, and enhance detection effectiveness. * Conduct proactive threat hunting using threat intelligence, behavioral analytics, and MITRE ATT&CK techniques. * Perform root cause analysis and recommend corrective and preventive actions. * Document investigation findings, incident timelines, lessons learned, and technical reports. * Assist in developing and maintaining Incident Response playbooks, SOPs, and workflows. * Support digital evidence collection and basic forensic activities while maintaining chain of custody. * Participate in security assessments, architecture reviews, tabletop exercises, phishing simulations, and readiness activities. * Support security reviews of IT systems, applications, and cloud services. * Assist with cybersecurity policies, standards, and operational procedures. * Collaborate with Cloud Security, Vulnerability Management, Infrastructure, and Application teams. * Monitor incident metrics and contribute to operational reporting. * Stay current on emerging threats and industry best practices. * Performs other job-related duties as assigned. Senior Incident Response Analyst Experience, Education, Skills, Abilities requested: * 5+ years of cybersecurity experience with at least 3 years in Incident Response, Security Operations, Threat Hunting, or Detection Engineering. * Hands-on experience investigating Windows, Linux, cloud, identity, and network incidents. * Experience with SIEM platforms such as Splunk ES, Microsoft Sentinel, QRadar, or similar. * Experience with EDR/XDR platforms such as Microsoft Defender, CrowdStrike, SentinelOne, or similar. * Knowledge of AWS GuardDuty, Security Hub, Azure Defender, or equivalent cloud security tools. * Strong understanding of MITRE ATT&CK and the incident response lifecycle. * Experience with log analysis, malware triage, threat hunting, and root cause analysis. * Strong written and verbal communication skills. * Ability to thrive in a fast-paced operational environment. * Experience with Splunk Enterprise Security correlation searches and detection tuning preferred. * Familiarity with Splunk SOAR or similar orchestration platforms preferred. * Experience supporting phishing investigations and tabletop exercises preferred. * Knowledge of FISMA, FedRAMP, NIST RMF, NIST 800-61, and NIST CSF preferred. * Python or PowerShell scripting experience preferred. * GCIH, GCIA, GCFA, CISSP, Security+, CySA+, or CEH certifications preferred. * Must be eligible to obtain and maintain a Public Trust. * Past applicable job experience may include, but is not limited to: Incident Response Analyst, Cybersecurity Analyst, Security Operations Center (SOC) Analyst, Threat Hunter, Detection Engineer, and Cyber Incident Responder. * Must pass pre-employment qualifications of Cherokee Federal. Company Information: Criterion is a part of Cherokee Federal — a team of tribally owned federal contracting companies supporting mission-critical programs across the federal sector. Similar searchable job titles: * Senior Incident Response Analyst * Senior Cybersecurity Analyst * Senior SOC Analyst * Cyber Incident Response Analyst * Cybersecurity Incident Responder * Threat Hunter * Detection Engineer * Security Operations Analyst * Senior Security Operations Analyst * Cyber Defense Analyst Keywords: * Incident Response * Cybersecurity * Security Operations * SOC * Threat Hunting * Detection Engineering * SIEM * Splunk Enterprise Security (Splunk ES) * Microsoft Sentinel * QRadar * EDR/XDR #CherokeeFederal #LI #AppC2 Cherokee Federal is a military friendly employer. Veterans and active military transitioning to civilian status are encouraged to apply. Legal Disclaimer: Cherokee Federal is an equal opportunity employer. Please visit cherokee-federal.com/careers for information regarding our Affirmative Action and Equal Opportunity Employer Statement, Accommodation request, and Presidential EO 14042 Notice.

Responsibilities

The role is responsible for identifying, investigating, and remediating cybersecurity incidents across enterprise and cloud environments. It involves collaborating with security teams to improve detection content, conducting proactive threat hunting, and developing incident response playbooks.