Senior Incident Response Analyst – Tier 3, IR Lead

🔥 17 hours ago

🇺🇸 United States – Remote

💵 $150k - $205k / year

⏰ Full Time

🟠 Senior

🚨 Incident Response Analyst

👻 Ghost score 0%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

phia, LLC

WebsiteLinkedInAll Job Openings

11 - 50 employees

Founded 2011

💼 Consulting

🎖️ Defense

📦 Logistics

Consulting • Defense • Logistics

<phia, LLC> is a cybersecurity firm that provides cyber assessments, cybersecurity operations, security engineering and development, and advisory services to help clients defend against advanced threats. The company leverages threat intelligence, operations-informed techniques, and industry standards to build resilient solutions and support mission success for its clients and partners.

📋 Description

• Triage, investigate, contain, and remediate cybersecurity incidents through resolution • Lead incidents end to end as the most senior analyst on the team • Review junior analysts' work and provide feedback for growth • Respond to APT and FIN threat actors and cloud-based AWS threats from detection through eradication and lessons learned • Investigate in Splunk SIEM and Microsoft Defender EDR • Build and tune Splunk SOAR playbooks • Pull AWS telemetry and map activity to MITRE ATT&CK • Follow NIST 800-61 incident handling practices • Recommend and implement process improvements with government staff • Support auditors during reviews of IR processes • Participate in a weekly after-hours on-call rotation, approximately one week in six • Author incident reports in Archer • Track investigations and documentation in GitHub • Perform QA on team member submissions before client delivery • Work directly with government staff and clients as part of a federal financial regulatory agency's cybersecurity operations

🎯 Requirements

• 5+ years of hands-on incident response experience • Experience handling and responding to an APT or FIN actor • Experience responding to cloud-based threats in an IR capacity, including AWS or Azure/M365 • Experience working directly with clients in a professional demeanor • Experience with Microsoft Defender EDR (preferred) or an equivalent enterprise EDR such as CrowdStrike or SentinelOne • Knowledge of SOC best practices • Ability to work with government staff to suggest and implement process improvements • Ability to work with auditors to respond to and resolve identified issues in IR processes • Ability to author clear and robust reports and review and ensure QA of team member submissions • Senior-level Incident Response certification: GIAC GCIH, GCFA, GCFR, GNFA, GREM, or EC-Council ECIH • Ability to participate in a weekly after-hours on-call rotation • Bachelor's Degree required • Public Trust / Suitability clearance; applicants selected will be subject to a security investigation • Must be a U.S. Citizen • Ability to work within core hours of approximately 7:30 AM–4:30 PM US Eastern Time, Monday through Friday • Experience with Splunk (SIEM) and Splunk SOAR, including playbook development • Experience with GitHub for investigation tracking and documentation • Experience with Archer (RSA/Archer GRC) as an incident system of record • Experience responding to incidents in AWS, including CloudTrail, GuardDuty, and IAM/credential abuse • Experience mapping activity to MITRE ATT&CK and following NIST 800-61 • Scripting for automation and triage using Python and SPL • Threat hunting experience • Ability to review work from junior analysts and provide feedback for growth

🏖️ Benefits

• Medical Insurance • Dental Insurance • Vision Insurance • Life Insurance • Short Term & Long Term Disability • 401k Retirement Savings Plan with Company Match • Paid Holidays • Paid Time Off (PTO) • Tuition and Professional Development Assistance

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume