[Hiring] Senior Incident Response Analyst @phia, LLC

Role Description

At phia, we hire talented and passionate people who are focused on collaborative, meaningful work, providing technical and operational subject matter expertise and support services to our partners and clients. phia is seeking a mission-driven Senior Incident Response Analyst to serve as a hands-on responder supporting a federal financial regulatory agency’s cybersecurity operations.

You will be the most senior responder on the team:

• Running incidents involving advanced persistent threat (APT) and financially motivated (FIN) actors and cloud-based attacks.
• Mentoring and reviewing the work of fellow analysts.
• Authoring clear, defensible reports for a demanding client.

Between incidents, the IR team dual-hats as Tier 3 escalation for the SOC. You will work directly with government staff, independently with some guidance, and share a weekly on-call rotation with the rest of the team.

Qualifications

• 5+ years of hands-on incident response experience.
• Experience handling an APT or FIN actor and responding to cloud-based threats (AWS or Azure/M365) in an IR capacity.
• Hands-on with Microsoft Defender EDR (preferred); strong CrowdStrike or SentinelOne responders are considered.
• Knowledge of SOC best practices and how a Tier 3 / IR team fits into them.
• Comfortable working directly with clients and government staff — including a demanding one — with a professional demeanor.
• Strong writing skills for clear incident reports and QA of others’ work.
• Experience leading or mentoring junior analysts and reviewing their work.

Requirements

• 5+ years of experience with incident response.
• Experience handling and responding to an APT or FIN actor and responding to cloud-based threats in an IR capacity.
• Experience working directly with clients in a professional demeanor.
• Experience with Microsoft Defender EDR (preferred) or an equivalent enterprise EDR such as CrowdStrike or SentinelOne.
• Knowledge of SOC best practices.
• Ability to work with government staff to suggest and implement process improvements, and to work with auditors to respond to and resolve identified issues in the IR processes.
• Ability to author clear and robust reports and to review and ensure QA of team member submissions.
• Senior-level Incident Response certification — GIAC GCIH is sufficient; GCFA, GCFR, GNFA, GREM, or EC-Council ECIH also accepted.
• Ability to participate in a weekly after-hours on-call rotation.

Preferred Skills

• Experience with Splunk (SIEM) and Splunk SOAR, including playbook development.
• Experience with GitHub for investigation tracking and documentation.
• Experience with Archer (RSA/Archer GRC) as an incident system of record.
• Experience responding to incidents in AWS (CloudTrail, GuardDuty, IAM/credential abuse).
• Experience mapping activity to MITRE ATT&CK and following NIST 800-61.
• Scripting for automation and triage (Python, SPL).
• Threat hunting experience.
• Ability to review work from junior analysts and provide feedback for growth.

Required Education + Clearance

• Bachelor’s Degree required.
• Senior-level Incident Response certification — GIAC GCIH is sufficient; GCFA, GCFR, GNFA, GREM, or EC-Council ECIH also accepted.
• Public Trust / Suitability; applicants selected will be subject to a security investigation.

GENERAL PROGRAM REQUIREMENTS

• Must be a U.S. Citizen.
• Expected 8.5-hour workday (with a 30-minute break) within core hours of approximately 7:30 AM – 4:30 PM US Eastern Time (ET), Monday through Friday; daily team meeting at 8:30 AM ET; schedule is flexible with advance notice.
• Weekly after-hours on-call rotation shared with five other team members (approximately one week in six).
• Fully remote within the United States; no time on the client site expected.
• Minimal travel.