CSOS II/Tier 2

Lead and support cyber incident response activities, including containment, eradication, and recovery actions such as IP/domain blocks and account disablement. Perform in-depth malware analysis, forensic artifact handling, and digital media analysis across host, server, and network environments. Coordinate investigations with internal and external partners, including Counterintelligence, Insider Threat, law enforcement, and other cybersecurity teams. Document all actions and findings in authorized systems to ensure clear, reproducible records of analysis and response. Categorize incidents, assess impact, and collaborate with stakeholders to ensure accurate and timely reporting. Produce incident timelines, reports, briefings, and other materials to keep leadership informed of threat activity and response actions. Develop indicators of compromise (IOCs) for distribution to cybersecurity stakeholders. Build, maintain, and—when authorized—execute custom scripts, tools, and capabilities for data collection, analysis, and response. Generate or update incident reports within JIMS, ICMS, and other approved systems as directed by the Government. Support de-confliction between blue/red team activities and active incidents. Provide comprehensive incident investigation reports that cover lifecycle analysis, adversary behavior, technical findings, and recommended improvements. This role operates on Shift 5 (Saturday and Sunday- Weekend 1800 - 0600).