Senior Incident Response Analyst

Lead and coordinate cyber incident response activities across the full lifecycle, including investigation, containment, eradication, and recovery. Analyze security events, logs, network traffic, and forensic artifacts to determine incident scope, root cause, and impact. Identify adversary tactics, techniques, and procedures (TTPs) to develop indicators of compromise and enhance threat detection. Develop, maintain, and enhance incident response processes, playbooks, workflows, and standard operating procedures. Configure, tune, and optimize security technologies, including SIEM, EDR, IDS/IPS, and monitoring tools to improve detection accuracy. Create detection content, including correlation rules, use cases, signatures, alerts, and automation scripts to strengthen SOC capabilities. Document investigations, response activities, and findings within case management systems, producing clear incident reports and after-action documentation. Establish and track SOC performance metrics and key performance indicators to measure operational effectiveness and support continuous improvement. This role supports a mission-critical government program within a hybrid environment in the Arlington, VA area.