Incident Response Analyst

Key Role:
Support the maturity of clients' Security Operations Center (SOC) related to cloud security capabilities. Oversee client engagements, including the building of an overall picture of the client's current structure, day-to-day operations, and outcomes in a manner that they may not have thought of before. Lead discussions and workshops to train SOC analysts on the development of their cloud security skills and develop incident response playbooks for responding to cloud security events. Respond to cloud-related security events and act as an escalation point for SOC analysts throughout the incident lifecycle. Due to the nature of work performed within this facility, U.S. citizenship is required.

Basic Qualifications:

• 3+ years of experience within a security operations center actively engaged with incident response activities, including analysis of artifacts, writing incident reports, and triaging of security events

• Experience with cloud native technologies across Cloud Service Providers such as AWS Guard Duty, Azure Defender for Cloud, AWS Macie, or Google Security Command Center

• Experience with cyber threat intelligence, digital forensics, red teaming, threat hunt, cloud incident response, counterintelligence, insider threat, and detection engineering

• Knowledge of external standards, including ISO 22301, ISO 22317, and NIST guidelines such as NIST 800-53 or NIST 800-61

• Ability to obtain and maintain a Public Trust or Suitability/Fitness determination based on client requirements

• Bachelor's degree

Additional Qualifications:

• Experience with advanced Microsoft Office products

• Experience with cyber technologies and capabilities, including continuous monitoring, incident response, advanced threat hunt, secure Cloud and mobile capabilities, ongoing assessment, digital forensics, and threat hunt

• Experience with cybersecurity tools and solutions such as Microsoft Defender for Endpoint, Corelight, Suricata or Snort, Palo Alto and Cisco firewalls, Archer Case Management, ServiceNow, Threat Connect, Splunk Enterprise Security, Splunk SOAR, Cofense, IronPort Mail Gateways, or Microsoft G5 Defender suite

• Knowledge of security tools and techniques used by cybersecurity teams

• Knowledge of the NIST 800-61 incident response lifecycle

• Knowledge of Cloud Native Application Protection Platforms and all corresponding components

• Possession of excellent client relationship-building and interpersonal skills

• Possession of excellent verbal and written communication skills

• CCSP, CySA+, CISSP, or Certification

Vetting:

Applicants selected will be subject to a government investigation and may need to meet eligibility requirements of the U.S. government client.

Compensation

At Booz Allen, we celebrate your contributions, provide you with opportunities and choices, and support your total well-being. Our offerings include health, life, disability, financial, and retirement benefits, as well as paid leave, professional development, tuition assistance, work-life programs, and dependent care. Our recognition awards program acknowledges employees for exceptional performance and superior demonstration of our values. Full-time and part-time employees working at least 20 hours a week on a regular basis are eligible to participate in Booz Allen's benefit programs. Individuals that do not meet the threshold are only eligible for select offerings, not inclusive of health benefits. We encourage you to learn more about our total benefits by visiting the Resource page on our Careers site and reviewing Our Employee Benefits page.

Identity Statement

As part of the application process, you are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.

Work Model
Our people-first culture prioritizes the benefits of flexibility and collaboration, whether that happens in person or remotely.

• If this position is listed as remote or hybrid, you'll periodically work from a Booz Allen or client site facility.
• If this position is listed as onsite, you'll work with colleagues and clients in person, as needed for the specific role.

Commitment to Non-Discrimination

All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local, or international law.