{"id":2262697,"url":"https://alion.io/job/leidos-incident-response-analyst-2","title":"Incident Response Analyst","company":{"id":7791,"name":"Leidos","domain":"leidos.com","url":"https://alion.io/company/leidos","size_band":"5000+","is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":78,"open_postings":241,"ghost_share":0.004,"stale_share":0.855,"repost_share":0.008,"time_to_fill_p50_days":27,"computed_at":"2026-10-22T06:10:10Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Alexandria, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":87100,"max":157450,"currency":"USD","period":"year","gross":null,"usd_annual":157450},"salary_estimate":null,"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"SIEM","optional":false}],"status":"closed","first_seen_at":"2026-10-09T00:00:00Z","employer_posted_date":"2026-10-09","last_verified_at":"2026-10-21T10:32:14Z","board_verified":false,"closed_at":"2026-10-21T10:32:14Z","days_open":12,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":12},"description":"Looking for an opportunity to make an impact?\nAt Leidos, we deliver innovative solutions through the efforts of our diverse and talented people who are dedicated to our customers’ success. We empower our teams, contribute to our communities, and operate sustainable. Everything we do is built on a commitment to do the right thing for our customers, our people, and our community. Our Mission, Vision, and Values guide the way we do business.\nIf this sounds like a mission you want to be a part of, keep reading!\nLeidos is seeking experienced Incident Response Analysts to support the Defense Manpower Data Center (DMDC) CyberPRIMES program. Leidos is a major partner on the contract and will provide a substantial portion of the cybersecurity workforce supporting the Defense Human Resources Activity (DHRA) and DMDC. The Incident Response Analyst will investigate and respond to cybersecurity events and incidents affecting DHRA systems and networks. This position supports the full incident-response lifecycle-from detection and analysis through containment, eradication, recovery, and post-incident activities-and works closely with Security Operations Center analysts, Cybersecurity Service Providers, system owners, and technical teams during active cybersecurity incidents.\nWork Locations:\nMark Center, Alexandria, Virginia - 2 positions\nDepartment of Defense Center - Monterey Bay, Seaside, California - 1 position\nMission Environment\nDMDC supports the Defense Human Resources Activity within the Office of the Under Secretary of Defense for Personnel and Readiness (OUSD(P&R)) and maintains the Department of Defense’s largest and most comprehensive central repository of personnel, manpower, casualty, pay, entitlement, personnel security, identity, readiness, training, and related data.\nThe DHRA Information Technology (IT) environment includes approximately 15,000 network and endpoint devices supporting more than 600 Government-Off-The-Shelf (GOTS) applications and approximately 100 Risk Management Framework (RMF) authorization boundaries managed through the Enterprise Mission Assurance Support Service (eMASS). Incident-response operations support both the Non-classified Internet Protocol Router Network (NIPRNet) and Secret Internet Protocol Router Network (SIPRNet) environments. Analysts must be able to move quickly from security-event identification into investigation and coordinated response while maintaining accurate records, preserving evidence, and keeping Government stakeholders informed.\n Primary Tasks\nSupport preparation, detection, analysis, containment, eradication, recovery, and post-incident activities for cybersecurity events and incidents.\nInvestigate cybersecurity incidents affecting NIPRNet and SIPRNet environments.\nPerform proactive security monitoring and analysis to identify potential intrusion attempts and other malicious activity.\nAnalyze security information from Security Information and Event Management (SIEM) platforms, endpoint-security capabilities, firewalls, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), web-security systems, antispam capabilities, malware-prevention systems, and related enforcement technologies.\nRecognize potential intrusion attempts, malicious activity, or other cybersecurity conditions requiring immediate investigation or mitigation.\nAssess cybersecurity events to determine scope, potential impact, affected systems, and required response actions.\nSupport containment and mitigation of active cybersecurity threats in accordance with approved Government procedures.\nCoordinate eradication and recovery activities with system owners, administrators, network personnel, cybersecurity teams, and other technical stakeholders.\nCollect and preserve technical evidence associated with cybersecurity events and incidents.\nMaintain complete and accurate incident records, timelines, supporting evidence, investigative findings, response actions, and status information.\nDevelop and contribute to required cybersecurity event and incident reporting.\nCoordinate incident-response activities with Security Operations Center analysts, Cybersecurity Service Providers (CSSPs), system owners, technical teams, and Government stakeholders.\nSupport escalation of significant cybersecurity events and incidents in accordance with established procedures.\nProvide timely status updates during active investigations and incident-response activities.\nSupport post-incident analysis and lessons learned to identify opportunities to improve monitoring, detection, response procedures, and defensive capabilities.\nParticipate in after-hours incident response when assigned and meet the contract-required one-hour recall requirement.\nBasic Qualifications\nBachelor’s degree and 4 or more years of relevant cybersecurity experience.\nExperience supporting cybersecurity incident response, Security Operations Center operations, cyber defense, or security-event investigation.\nExperience performing analysis of cybersecurity events and determining appropriate response or escalation actions.\nExperience supporting incident containment, eradication, recovery, and post-incident activities.\nExperience monitoring and analyzing enterprise cybersecurity tools and security telemetry.\nExperience documenting incident timelines, investigative findings, evidence, response actions, and status.\nExperience coordinating cybersecurity incidents across technical teams and stakeholder organizations.\nWorking knowledge of network, endpoint, and enterprise cybersecurity monitoring concepts.\nAbility to recognize potential intrusion activity and support rapid mitigation of cybersecurity threats.\nAbility to communicate clearly during active cybersecurity incidents and maintain accurate documentation under time-sensitive conditions.\nAbility to support after-hours incident response and the required one-hour recall when assigned.\nU.S. Citizenship required.\nActive Secret security clearance required.\nPreferred Qualifications\nExperience supporting cybersecurity incident response within Department of Defense or Federal environments.\nExperience responding to incidents in both unclassified and classified network environments.\nExperience with Security Information and Event Management platforms and enterprise security-monitoring capabilities.\nExperience analyzing endpoint-security, firewall, Intrusion Detection System, Intrusion Prevention System, web-security, antispam, or malware-prevention data.\nExperience supporting evidence collection and preservation during cybersecurity investigations.\nExperience coordinating incident response with Security Operations Center personnel, Cybersecurity Service Providers, system owners, network teams, and other technical organizations.\nExperience operating in a 24x7 cybersecurity operations environment or supporting after-hours incident response.\nFamiliarity with Department of Defense cybersecurity incident-response processes and requirements.\nFamiliarity with DHRA, DMDC, or comparable Department of Defense enterprise environments.\nIf you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo - because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 - and moving faster than anyone else dares.\nOriginal Posting:\nOctober 9, 2026For U.S. Positions: While subject to change based on business needs, Leidos reasonably anticipates that this job requisition will remain open for at least 3 days with an anticipated close date of no earlier than 3 days after the original posting date as listed above.\nPay Range:\nPay Range $87,100.00 - $157,450.00The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.","description_format":"text","description_chars":8136,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","National Security","C4ISR","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-11T05:28:41Z"},{"event":"close","at":"2026-10-21T10:32:14Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 50 · green card filings: 24","filings_12m":50,"filings_prev_12m":58,"green_card_filings_12m":24,"median_offered_wage_usd":124257,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":4}],"liveness":null,"pay":{"stated_usd_annual":157450,"is_top_pay":true},"html_url":"https://alion.io/job/leidos-incident-response-analyst-2","json_url":"https://alion.io/job/leidos-incident-response-analyst-2.json","meta":{"generated_at":"2026-10-23T01:30:31Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2474,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":7791},"rest":"https://alion.io/mcp/rest/get_company?id=7791"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fleidos-incident-response-analyst-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fleidos-incident-response-analyst-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fleidos-incident-response-analyst-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/leidos-incident-response-analyst-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fleidos-incident-response-analyst-2"}]}