Cyber Security Incident Response Analysis II - Digital Forensics and Incident Response

Position Overview

This position supports the cybersecurity program at the U.S. Department of Energy (DOE) Hanford Site in Richland, Washington. The Analyst detects, investigates, and responds to cybersecurity incidents across a FISMA Moderate IT enterprise and supporting industrial control system (ICS) / operational technology (OT) environments governed by DOE Order 205.1C and NIST SP 800-53 Rev. 5. Working with increasing independence under the guidance of senior analysts, the Analyst handles assigned incidents from triage through closure, performs host, memory, network, and cloud forensic analysis, and contributes to detection content, playbooks, and post-incident improvements. This role suits analysts with foundational DFIR experience who are ready to take ownership of investigations of moderate complexity.

Major Activities (Typical Duties/Responsibilities)

• Monitor, triage, and analyze security alerts and events from SIEM, EDR, NDR, SOAR, email security, and other enterprise security platforms; validate findings and escalate in accordance with established procedures.
• Act as incident handler for assigned incidents from detection through closure, including scoping, containment, eradication, and recovery recommendations, in alignment with NIST SP 800-61 Rev. 3, the CISA federal incident response playbook, and the site incident response plan.
• Conduct forensic acquisition and analysis of endpoints, servers, memory, logs, and network traffic (disk imaging, live triage collection, memory analysis, timeline and artifact analysis) to determine root cause, scope, and impact.
• Investigate account compromise, business email compromise, and data exposure using identity and cloud audit sources (e.g., Microsoft 365 Unified Audit Log, Entra ID sign-in and audit logs).
• Preserve evidence and maintain chain of custody in accordance with NIST SP 800-86 and site procedures, supporting potential referral to the DOE Office of Inspector General, law enforcement, or legal counsel.
• Document incident activity in the case management system (e.g., ServiceNow); prepare incident reports, timelines, and root cause analyses; and support incident reporting to DOE, including the Integrated Joint Cybersecurity Coordination Center (iJC3), within required timelines under DOE O 205.1C.
• Conduct hypothesis-driven threat hunts informed by threat intelligence and MITRE ATT&CK (including ATT&CK for ICS), including targeted hunts in response to CISA Emergency Directives, Binding Operational Directives, and DOE threat notifications.
• Develop and tune detection content and indicators of compromise (IOCs), such as SPL/KQL queries and Sigma and YARA rules, based on investigation findings and emerging threats.
• Coordinate with ICS/OT engineering staff during incidents affecting operational environments, using non-intrusive collection methods that protect safety and operational availability.
• Monitor threat intelligence from DOE, CISA, and other sources; distribute threat advisories and incident summaries to customers and leadership.
• Contribute to incident response playbooks, standard operating procedures, and the incident response plan; participate in tabletop and functional exercises and after-action reviews, and track corrective actions to closure, including POA&M entries where applicable.
• Support cyber security audits, assessments, and data calls related to incident response, audit logging (including OMB M-21-31 event logging requirements), and continuous monitoring.
• Support operation and maintenance of forensic and incident response tools.
• Share knowledge with and assist in training Level I analysts and interns.
• Perform other duties as appropriate and as assigned.

Knowledge/Skills/Abilities

• Two (2) or more years of experience in cyber security, including hands-on incident response, digital forensics, or security operations center (SOC) experience
• Working knowledge of federal incident response and forensics requirements, including NIST SP 800-61 Rev. 3, NIST SP 800-86, NIST SP 800-53 Rev. 5 (IR and AU control families), and DOE O 205.1C.
• Hands-on experience with forensic and triage tools (e.g., Magnet AXIOM, FTK, EnCase).
• Experience with SIEM, EDR, and network analysis tools (e.g., Splunk, Microsoft Sentinel, CrowdStrike Falcon, Microsoft Defender for Endpoint, Zeek, Wireshark).
• Working knowledge of Windows and Linux internals and forensic artifacts (registry, event logs, file systems, persistence mechanisms), Active Directory, network protocols, and common malware behavior.
• Ability to map adversary tactics, techniques, and procedures (TTPs) to MITRE ATT&CK and translate findings into detection and containment actions.
• Basic scripting ability (e.g., PowerShell, Python) to automate collection, parsing, and analysis tasks.
• Strong analytical, troubleshooting, and problem-solving skills, with attention to detail and accuracy in documentation.
• Excellent written and verbal communication skills, including the ability to explain technical findings to non-technical audiences.
• Ability to remain composed, set and manage priorities, and work cooperatively in a team during time-sensitive, high-pressure incidents.
• High degree of sensitivity regarding confidential information and sensitive investigations.

Physical Abilities

• Sufficient fine motor skills for the use of computers, calculators with an ability to withstand repetitive keyboarding for extended periods of time.
• Visual and communications ability adequate to perform the essential functions of the job.
• Ability to kneel, bend and twist at the waist on an occasional basis.
• Ability to reach below shoulder height with regular frequency (desk position) and at or above shoulder height on occasion.
• Ability to push, pull, carry and lift objects weighing up to 10 pounds on a regular basis, and greater weights on an occasional basis.
• Ability to travel by vehicle or aircraft, and ability to safely operate a motor vehicle

Minimum Requirements

• BA/BS degree in Cyber Security, Computer Science, Digital Forensics, Information Technology, or a related field; and 2 or more years relevant experience or an equivalent combination of education, training and experience.
• Ability to participate in an after-hours on-call rotation and to report on-site to the Hanford Site in Richland, Washington as needed during incident response.
• Ability to pass a pre-employment background check and drug screening.
• Must have identification compliant with the REAL ID Act at time of hire.
• Must be able to obtain and maintain a Department of Energy access authorization (HSPD-12 PIV credential); this requires a successful federal background investigation. Declarations of illegal drug use, including marijuana and cannabis derivatives (regardless of state law), within the last year may affect eligibility.
• US citizenship required.
• Must reside within the US; work cannot be performed from outside the US.

Preferred Qualifications

• CompTIA Security+ (or GIAC GSEC or ISC2 SSCP) and Splunk Core Certified User certifications; ISC2 Certified in Cybersecurity (CC) or CompTIA Network+ also valued.
• Completion of SOC analyst training such as Splunk Fundamentals.
• Experience supporting incident response in DOE or other federal FISMA-regulated environments.
• Experience with cloud incident response (Microsoft 365, Azure, Entra ID), introductory malware analysis, or SOAR playbook development.

Pay Range: $80,000.00 $129,000.00

Benefits: OSC Technical Solutions offers excellent benefits for eligible employees. Benefits include paid holidays, paid time off, 401k with employer match, dental, vision, health insurance plans through the Federal Employee Health Benefits (FEHB) program, as well as life and disability benefits.

OSC Technical Solutions does not discriminate, and the company provides equal employment opportunity for all employees and applicants without regard to race, religion, color, sex, gender, sexual orientation, national origin, citizenship status, age, marital status, pregnancy or parenthood, handicap or disability, genetics, veteran status or any other legally protected characteristic. OSC Technical Solutions adheres to all federal, state and local laws regarding equal employment opportunity and will not discriminate against you in violation of these laws. OSC Technical Solutions reserves the right to apply CIRI Shareholder preference to qualified Shareholders in employment and advancement opportunities.

OSC Technical Solutions participates in E-Verify. We will provide the Social Security Administration (SSA) and, if necessary, the Department of Homeland Security (DHS), with information from each new employee's Form I-9 to confirm work authorization.

Reasonable Accommodation:

OSC Technical Solutions will provide reasonable accommodations, according to applicable state and federal laws, to all qualified individuals with physical or mental disabilities. In compliance with the ADA Amendments Act (ADAAA), if you have a disability and would like to request an accommodation in order to apply for a position with OSC Global, LLC or any of its subsidiaries, please email recruiting@ciri.com.

Important Employment Notice: Federal Contract & RCW 49.44.240:

Due to our status as a federal contractor operating within the State of Washington, all applicants and employees must adhere to federal law, which classifies cannabis as a Schedule I controlled substance.

While Washington State’s RCW 49.44.240 (which generally prohibits employers from discriminating against an applicant based on their lawful use of cannabis off-site and during working hours) is state law, it does not supersede federal requirements.

Zero-Tolerance Policy and Disqualification

• Prohibition: The use, possession, or distribution of cannabis is strictly prohibited for all employees, regardless of state law.
• Testing: Applicants will be subject to pre-employment drug screening that includes testing for cannabis.
• Disqualification: A positive test result for cannabis will result in immediate disqualification from consideration for employment, as mandated by our federal contract obligations.

All applicants must be able to comply with all federal regulations, including those concerning controlled substances, as a condition of employment.

In compliance with Homeland Security Presidential Directive 12 (HSPD-12) and Department of Energy (DOE) Hanford Field Office (HFO) direction, employees issued initial badges on or after September 1st, 2025, are required to obtain and maintain a HSPD-12 Personal Identity Verification (PIV) Credential. To obtain this credential, new employees must successfully complete and pass a federal background check investigation. This investigation encompasses multiple areas of eligibility and includes a declaration of illegal drug activities, including use, supply, possession, or manufacture within the last year. This includes marijuana and cannabis derivatives, which are still considered illegal under federal law, regardless of state laws.