Note: The job is a remote job and is open to candidates in USA. Peraton is hiring a Senior Incident Response Analyst to support incident response for the Covered California and CalHEERS environments. The role leads end-to-end incident handling, develops playbooks, manages SIEM and SOAR detection engineering, conducts threat hunting, coordinates investigations, and reports incidents within contractual and regulatory timelines.
Responsibilities
- Lead incident response end to end. Own triage, containment, eradication, recovery, and post-incident review, and serve as backup incident manager in coordination with the client Information Security Officer and the Security Services Manager
- Build and exercise the playbooks. Develop and maintain incident response playbooks and runbooks, and exercise them through tabletop and functional drills
- Own detection and monitoring. Drive SIEM and SOAR content development, log source onboarding, alert tuning, and detection engineering across cloud and on-premises telemetry
- Hunt proactively. Conduct threat hunting mapped to MITRE ATT&CK, and turn hunt findings into durable detections
- Run defensible investigations. Coordinate evidence handling and chain of custody, communications, escalation, and reporting; produce post-incident reports and lessons-learned; engage the digital forensics examiner when a matter requires formal forensic examination or evidence for legal, HR, or privacy proceedings
- Meet the contract's clock. Build and operate response procedures that satisfy the engagement's tight notification obligations, including notification within one hour when personnel no longer require system access, and the Privacy Addendum's breach-reporting timelines
- Report to leadership and support adjacent work. Provide incident status and escalation reporting to security leadership on defined timelines, and support vulnerability management and logging and monitoring coordination
Skills
- Bachelor's degree in cybersecurity or computer science. In lieu of a degree, an additional 4 years of relevant experience will be considered
- 8+ years of cybersecurity experience with demonstrated hands-on incident response leadership
- Active GCIH or GCIA certification
- Hands-on experience with enterprise SIEM and SOAR platforms (for example Splunk or Microsoft Sentinel), including detection engineering, log source onboarding, and alert tuning
- Demonstrated threat hunting experience using MITRE ATT&CK, plus malware triage and network and host forensics fundamentals
- Demonstrated experience leading incidents as the incident lead or commander, including evidence handling, chain of custody, executive incident communication, and post-incident reporting
- Working knowledge of NIST SP 800-61 incident handling practice within a NIST SP 800-53 Rev. 5 control context, and scripting ability for response and detection automation
- US Citizenship and the abillity to pass a California criminal background clearance (Gov. Code §1043 / 10 CCR §6456) before starting work or accessing any confidential information, PII, PHI, federal tax information, or financial information
- GCFA certification. CISSP, GCED, or GNFA are also valued
- Incident response experience in environments containing PII, PHI, and federal tax information
- Experience in CMS-regulated environments or state health benefit exchange environments
- Familiarity with ARC-AMPE and IRS Publication 1075 incident handling and reporting obligations
- Experience in California state government or comparable public-sector environments
- Experience coordinating with external forensic providers, law enforcement, and regulators during an incident
- Experience building or maturing a detection engineering practice, including detection-as-code
Benefits
- Remote work allowed 100%
- Employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.
Company Overview