Senior Cyber Defense Analyst – Incident Response Lead (CDA Lead / IR Lead)

• Lead the Cyber Defense Analyst team, providing direction on monitoring priorities, triage, and incident investigations.
• Act as Incident Response Lead (IRL) during escalations, coordinating containment, remediation, and reporting across NSOC, DCAI engineers, and mission partners.
• Validate and adjudicate escalated detections from AI-assisted SOC tools, ensuring accuracy, prioritization, and timely response.
• Mentor and coach analysts in advanced detection, threat hunting, and IR skills; provide regular feedback and performance oversight.
• Serve as primary liaison between analysts and engineering teams (DCAI, Detection Engineering) to refine AI models, SOAR playbooks, and detection logic.
• Direct threat hunting operations based on adversary TTPs, threat intelligence, and anomaly detection.
• Ensure incidents are documented to NSOC standards, with case studies and lessons learned integrated into playbooks.
• Lead red/blue team exercises and tabletop drills to validate analyst readiness and IR procedures.
• Provide senior-level reporting and executive briefings on major incidents to NSOC leadership and external stakeholders.
• Maintain compliance with RMF, CSSP, and NSOC SOPs; validate AI-augmented IR processes meet accreditation requirements.

• Active or eligible SECRET security clearance (must be willing to obtain and maintain).
• Bachelor’s Degree in Cybersecurity, Computer Science, Information Systems, or related technical discipline; equivalent work experience considered.
• 5+ years of SOC/NSOC or cyber defense experience, with demonstrated IR and threat hunting expertise.
• DoD 8140 Intermediate compliant (GFACT or CEH or Cloud+ or CySA+ or PenTest+ or SSCP or Security+ or GSEC).
• Proven experience leading analyst teams or serving as a shift/incident lead.
• Strong knowledge of adversary TTPs (MITRE ATT&CK), malware analysis, and advanced detection/response techniques.
• Proficiency with SIEM, EDR, SOAR, and packet capture/analysis tools (e.g., Wireshark, Zeek).
• Strong leadership, communication, and briefing skills for technical and executive audiences.

• Active Top Secret clearance with ability to obtain/maintain TS/SCI.
• Advanced certifications such as GCIA, GCIH, GDAT, CISSP, or GCTI.
• Experience in a military cyber defense environment or enterprise-level 24/7 SOC.
• Prior IR Lead/Tier 3 response experience with major incident coordination responsibilities.
• Experience working alongside AI/ML-assisted SOC platforms and automation pipelines.

• Location: Hawaii NSOC.
• Schedule: Core leadership role with daytime hours and on-call responsibilities for after-hours escalations.
• Environment: Fast-paced, mission-critical operations requiring flexibility for major incident handling.
• Relocation packages may include a two-year commitment.

SOSi