Incident Response Analyst II - 561

JOB RESPONSIBILITIES:

• The primary responsibilities of this position are incident handling and response as a member of a Computer Security Incident Response Team (CSIRT). Analyst will respond to computer security incidents and escalate when necessary as well as coordinate response to computer security incidents. Recommend a course of action on each incident. Creates, manages, and records all actions taken by Incident Response Teams. Serve as initial POC for Events of Interest reported both internally and externally. Establishes alarm/incident escalation process. Tracks, follows-up, and resolves incidents. Provides internal incident coordination. Will be responsible for initiating forensic investigations and working closely with the forensics team to conduct and participate in cyber investigations. Initiates and maintains contact with affected parties during incident response life cycle. Investigates potential incidents/intrusions. Follows up on post incident actions. Consults with investigative/enforcement entities on declared incidents.
• Provide consulting advice on vulnerabilities or potential vulnerabilities within architecture.
• Communicate with excellent oral and written skills findings of such reports to all levels within TSA and DHS from executive staff to working level.
• Work closely with TSA staff to collaborate with DHS and other affiliated organizations during incident investigations or to obtain information for investigations.
• Develop and provide analysis reports.
• Provide consulting of known system vulnerabilities and exploits and develop and provide reports of such.
• Provide support, reports and all related deliverables on chain of custody' matters.
• This position may require on call duty.

REQUIREMENTS:
Must possess a background in incident handling, response and intrusion detection (IDS) experience. Requires 2 years of related security experience and possess a BS degree. If candidate does not possess a degree then he/she must possess 4 years of experience. Perform daily analytical actions in the performance of responding to incidents, identifying appropriate mitigation actions, identifying proper escalation procedures, and analysing data collection and reporting requirements. Assist in developing, managing, communicating, and executing an incident response program and initiating forensic investigations. It is preferred that this person be a current Certified Information Systems Security Professional (CISSP), or similar security professional certification. Experience with Encase Enterprise edition or other Forensics tools is a plus.