Cyber Security Incident Response Analysis II - Digital Forensics and Incident Response

Position Overview
This position supports the cybersecurity program at the U.S. Department of Energy (DOE) Hanford Site in Richland, Washington. The Analyst detects, investigates, and responds to cybersecurity incidents across a FISMA Moderate IT enterprise and supporting industrial control system (ICS) / operational technology (OT) environments governed by DOE Order 205.1C and NIST SP 800-53 Rev. 5. Working with increasing independence under the guidance of senior analysts, the Analyst handles assigned incidents from triage through closure, performs host, memory, network, and cloud forensic analysis, and contributes to detection content, playbooks, and post-incident improvements. This role suits analysts with foundational DFIR experience who are ready to take ownership of investigations of moderate complexity.
Major Activities (Typical Duties/Responsibilities)
Monitor, triage, and analyze security alerts and events from SIEM, EDR, NDR, SOAR, email security, and other enterprise security platforms; validate findings and escalate in accordance with established procedures.
Act as incident handler for assigned incidents from detection through closure, including scoping, containment, eradication, and recovery recommendations, in alignment with NIST SP 800-61 Rev. 3, the CISA federal incident response playbook, and the site incident response plan.
Conduct forensic acquisition and analysis of endpoints, servers, memory, logs, and network traffic (disk imaging, live triage collection, memory analysis, timeline and artifact analysis) to determine root cause, scope, and impact.
Investigate account compromise, business email compromise, and data exposure using identity and cloud audit sources (e.g., Microsoft 365 Unified Audit Log, Entra ID sign-in and audit logs).
Preserve evidence and maintain chain of custody in accordance with NIST SP 800-86 and site procedures, supporting potential referral to the DOE Office of Inspector General, law enforcement, or legal counsel.
Document incident activity in the case management system (e.g., ServiceNow); prepare incident reports, timelines, and root cause analyses; and support incident reporting to DOE, including the Integrated Joint Cybersecurity Coordination Center (iJC3), within required timelines under DOE O 205.1C.
Conduct hypothesis-driven threat hunts informed by threat intelligence and MITRE ATT&CK (including ATT&CK for ICS), including targeted hunts in response to CISA Emergency Directives, Binding Operational Directives, and DOE threat notifications.
Develop and tune detection content and indicators of compromise (IOCs), such as SPL/KQL queries and Sigma and YARA rules, based on investigation findings and emerging threats.
Coordinate with ICS/OT engineering staff during incidents affecting operational environments, using non-intrusive collection methods that protect safety and operational availability.
Monitor threat intelligence from DOE, CISA, and other sources; distribute threat advisories and incident summaries to customers and leadership.
Contribute to incident response playbooks, standard operating procedures, and the incident response plan; participate in tabletop and functional exercises and after-action reviews, and track corrective actions to closure, including POA&M entries where applicable.
Support cyber security audits, assessments, and data calls related to incident response, audit logging (including OMB M-21-31 event logging requirements), and continuous monitoring.
Support operation and maintenance of forensic and incident response tools.
Share knowledge with and assist in training Level I analysts and interns.
Perform other duties as appropriate and as assigned.
Knowledge/Skills/Abilities
Two (2) or more years of experience in cyber security, including hands-on incident response, digital forensics, or security operations center (SOC) experience
Working knowledge of federal incident response and forensics requirements, including NIST SP 800-61 Rev. 3, NIST SP 800-86, NIST SP 800-53 Rev. 5 (IR and AU control families), and DOE O 205.1C.
Hands-on experience with forensic and triage tools (e.g., Magnet AXIOM, FTK, EnCase).
Experience with SIEM, EDR, and network analysis tools (e.g., Splunk, Microsoft Sentinel, CrowdStrike Falcon, Microsoft Defender for Endpoint, Zeek, Wireshark).
Working knowledge of Windows and Linux internals and forensic artifacts (registry, event logs, file systems, persistence mechanisms), Active Directory, network protocols, and common malware behavior.
Ability to map adversary tactics, techniques, and procedures (TTPs) to MITRE ATT&CK and translate findings into detection and containment actions.
Basic scripting ability (e.g., PowerShell, Python) to automate collection, parsing, and analysis tasks.
Strong analytical, troubleshooting, and problem-solving skills, with attention to detail and accuracy in documentation.
Excellent written and verbal communication skills, including the ability to explain technical findings to non-technical audiences.
Ability to remain composed, set and manage priorities, and work cooperatively in a team during time-sensitive, high-pressure incidents.
High degree of sensitivity regarding confidential information and sensitive investigations.
Physical Abilities
Sufficient fine motor skills for the use of computers, calculators with an ability to withstand repetitive keyboarding for extended periods of time.
Visual and communications ability adequate to perform the essential functions of the job.
Ability to kneel, bend and twist at the waist on an occasional basis.
Ability to reach below shoulder height with regular frequency (desk position) and at or above shoulder height on occasion.
Ability to push, pull, carry and lift objects weighing up to 10 pounds on a regular basis, and greater weights on an occasional basis.
Ability to travel by vehicle or aircraft, and ability to safely operate a motor vehicle
Minimum Requirements
BA/BS degree in Cyber Security, Computer Science, Digital Forensics, Information Technology, or a related field; and 2 or more years relevant experience or an equivalent combination of education, training and experience.
Ability to participate in an after-hours on-call rotation and to report on-site to the Hanford Site in Richland, Washington as needed during incident response.
Ability to pass a pre-employment background check and drug screening.
Must have identification compliant with the REAL ID Act at time of hire.
Must be able to obtain and maintain a Department of Energy access authorization (HSPD-12 PIV credential); this requires a successful federal background investigation. Declarations of illegal drug use, including marijuana and cannabis derivatives (regardless of state law), within the last year may affect eligibility.
US citizenship required.
Must reside within the US; work cannot be performed from outside the US.
Preferred Qualifications
CompTIA Security+ (or GIAC GSEC or ISC2 SSCP) and Splunk Core Certified User certifications; ISC2 Certified in Cybersecurity (CC) or CompTIA Network+ also valued.
Completion of SOC analyst training such as Splunk Fundamentals.
Experience supporting incident response in DOE or other federal FISMA-regulated environments.
Experience with cloud incident response (Microsoft 365, Azure, Entra ID), introductory malware analysis, or SOAR playbook development.
Pay Range: $80,000.00 $129,000.00
Benefits: OSC Technical Solutions offers excellent benefits for eligible employees. Benefits include paid holidays, paid time off, 401k with employer match, dental, vision, health insurance plans through the Federal Employee Health Benefits (FEHB) program, as well as life and disability benefits.
OSC Technical Solutions does not discriminate, and the company provides equal employment opportunity for all employees and applicants without regard to race, religion, color, sex, gender, sexual orientation, national origin, citizenship status, age, marital status, pregnancy or parenthood, handicap or disability, genetics, veteran status or any other legally protected characteristic. OSC Technical Solutions adheres to all federal, state and local laws regarding equal employment opportunity and will not discriminate against you in violation of these laws. OSC Technical Solutions reserves the right to apply CIRI Sharehol

Employment type
Active, Full-Time

Work arrangement
No