New

Cyber Incident Analyst

Lafayette Group Inc.
$80,000-$130,000 - LGI carefully considers various factors when determining salary, including but not limited to education and training, professional experience, knowledge, skills and competencies, licensure and certifications, contract-specific affordabi
United States, Virginia, Arlington
Dec 24, 2025
Lafayette Group is seeking experienced professionals to provide advanced consulting support for federal cybersecurity programs. The Cyber Incident Analyst provides deep technical analysis during active cyber incidents, including insights into vulnerabilities, adversarial tactics, and mitigation strategies across diverse environments like IT, OT/ICS, cloud, and AI systems. This role requires demonstrated expertise in incident monitoring and response coordination, combined with strong consulting skills. This position engages with partners across government, industry, and critical infrastructure to provide guidance and analysis on active cyber threats. This position requires the ability to coordinate among diverse stakeholder groups, evaluate cyber intelligence for impact, conduct in-depth technical research, and translate technical data into guidance that informs decision-making. The ideal candidate for this role is an experienced, collaborative team member with deep expertise in cybersecurity operations with an innate curiosity to learn, and the drive to excel with a team of like-minded colleagues in a dynamic environment. This position will: Job Responsibilities Perform analysis on active cyber incidents, events and vulnerabilities to provide guidance and targeted recommendations for mitigation. Support the development of written guidance and recommendations to assist client's partners with solutions for active and ongoing cyber vulnerabilities. Remain current with emerging technologies and trends in cybersecurity and apply this knowledge to improve threat detection and mitigation efforts. Through hands-on analysis provide insights into vulnerabilities, adversarial tactics, and mitigation strategies across diverse environments like IT, OT/ICS, cloud, and AI systems. Assist with mapping technical insights on cyber threats to frameworks like MITRE ATT&CK and other cyber frameworks. Support the translation of strategic products into clear, practical formats that are tailored to the specific needs and operational constraints of different stakeholder groups, including large and small jurisdictions and critical infrastructure (CI) partners. Assist in the tailoring of vulnerability mitigation recommendations and contextualized examples to stakeholders to address implementation challenges and encourage rapid adoption. Required Skills Bachelor's or Master's degree in cybersecurity, information technology, political science, or a related field. 6+ years of professional experience in cyber analysis, threat intelligence, cyber security, incident response, or similar role. Demonstrated expertise in cyber incident response coordination, incident monitoring, and operational reporting. Strong understanding of current cyber threats/exploits, attack methodology, and detection techniques using a wide variety of security products including COTS and open source. Strong understanding of computer and network fundamentals; working understanding of computer architecture, operating systems, vulnerabilities, encryption, etc. Experience defining data sources and writing detection rules for discovering malicious behavior. Possession of excellent analytical and critical thinking skills with the ability to remain open-minded, flexible and curious in problem-solving approach. Possession of excellent oral and written communication skills. Ability to manage time effectively to meet deadlines, adhere to project plans, and work on several projects simultaneously; strong organizational skills and attention to detail. Proficient with Microsoft Office Suite. Active TS security clearance and SCI eligibility; US citizenship with the ability to obtain and maintain DHS Suitability (EOD). Desired Skills Familiarity with the .gov Cyber Mission space and legal constraints applicable to civilian Government Agencies (e.g., FISMA). Experience collecting, analyzing, and categorizing threat intelligence data from multiple sources to author actionable intelligence reports. Familiarity with at least one scripting language such as Python, and capable of manipulating data, interfacing with APIs, automating repetitive tasks, etc. Ability to interpret complex cybersecurity topics and effectively communicate or present information to various groups of stakeholders (e.g., Executives, SOC). Field-related certifications such as (CTIA, CEH, GREM, GCIH, GCFA). Experience with tools in both Linux and Windows environments. Experience applying AI/ML to identify anomalous behavior in security data, esp. using Elasticsearch. Familiarity with MITRE ATT&CK and/or similar frameworks. Location: Arlington, VA; on-site 3-5 per week Salary Range: $80,000-$130,000 LGI carefully considers various factors when determining salary, including but not limited to education and training, professional experience, knowledge, skills and competencies, licensure and certifications, contract-specific affordability, and organizational requirements. New employees are not usually hired at the top of the estimated salary range and salary decisions depend on the circumstances and factors for each case. Salary is only one aspect of LGI's generous total compensation package. Federal Contracts: This position involves working on federal contracts that require all workers on the contract to be U.S. Citizens. Additionally, some contracts may require the ability to obtain a security clearance. Contingent Hire: This position will be hired contingent upon winning the Federal contract work. LGI is committed to the full inclusion of all qualified individuals. As part of this commitment, we will ensure that persons with disabilities are provided reasonable accommodations for the hiring process. If reasonable accommodation is needed, please contact talent@lafayettegroup.com. This email address is for accommodation requests only. Non-related messages will be disregarded.