SITEC - Cyber Defense Incident Responder - MacDill AFB

Peraton requires a Cyber Defense Incident Responder to support the Special Operation Command Information Technology Enterprise Contract (SITEC) – 3 EOM.  This position is located at MacDill AFB in Florida.

 

The purpose of the Special Operations Forces Information Technology Enterprise Contract (SITEC) 3 Enterprise Operations and Maintenance (EOM) Task Order (TO) is to provide USSOCOM, its Component Commands, its Theater Special Operations Commands (TSOCs), and its deployed forces with Operations and Maintenance (O&M) services to maintain Network Operations (NetOps); maintain systems and network infrastructure; provide end user and common device support; provide configuration, change, license, and asset management; conduct training, and perform Install, Move, Add, Change (IMACs) services. The responsibilities and tasks associated with each requirement play a pivotal role to USSOCOM, the CIO/J6 organization, and ultimately the end-user who operate around the globe 24x7x365. 

 

The Cyber Defense Incident Responder serves as the primary technical operator responsible for detecting, investigating, containing, eradicating, and recovering from confirmed security incidents across enterprise, hybrid, and multi-cloud enclaves. Anchored squarely within the reactive phase of defensive cyber operations, this role executes rapid-response protocols to isolate active adversaries, halt unauthorized lateral movement and systematically mitigate active threats.

• Conduct immediate assessment and validation of inbound escalations, determining scope, impact, severity, and root cause of live security incidents.
• Execute immediate response actions to isolate compromised endpoints, sever malicious network connections, and halt unauthorized lateral movement across enclaves.
• Conduct host-based and network digital forensics, including volatile memory analysis, disk imaging, and artifact extraction to reconstruct adversary timelines.
• Eliminate adversary persistence mechanisms, purge unauthorized credentials, and validate clean system baselines prior to returning services to normal operations.
• Maintain strict chain-of-custody documentation, produce formal Incident Summaries and After-Action Reports (AARs), and provide root-cause findings to the detection engineering team.
• Perform static and dynamic triage of recovered malicious binaries, scripts, and dropper files to extract hardcoded IOCs, persistence mechanisms, and execution behavior.
• Identify, catalog, and remove all adversary-created persistence artifacts, such as unauthorized scheduled tasks, rogue services, modified registry keys, and hidden backdoor accounts.
• Author comprehensive Incident Summaries and After-Action Reports (AARs) detailing attack vectors, impact timelines, and defensive breakdowns for mission leadership and stakeholders.
• Coordinate with legal counsel, law enforcement, and regulatory compliance authorities to share sanitized forensic evidence and ensure reporting mandates are met within required timelines.
• Design, facilitate, and participate in scenario-based tabletop exercises (TTXs) with leadership, IT operations, and mission stakeholders to test decision-making and operational readiness.
• Author and continuously update operational IR playbooks for specific attack scenarios (e.g., ransomware, supply chain compromise, business email compromise) and maintain readiness of the forensic toolkit (triage scripts, collection images).
• Query and analyze diverse telemetry streams across SIEM, centralized log repositories, and event managers to correlate disparate activities into a cohesive investigative trail.
• Aggregate forensic artifacts, authentication logs, and network connection records to construct precise chronological timelines detailing adversary initial access, execution, and lateral movement.
• Leverage Endpoint Detection and Response (EDR) platforms to execute live system queries, inspect active process trees, analyze parent-child relationships, and identify unauthorized execution artifacts.
• Utilize network traffic analyzers, packet capture (PCAP) inspection tools, and NetFlow/IPFIX logs to trace external communication channels, quantify data volume, and inspect malicious payloads.
• Maintain structured investigative notes, evidence logs, and task tracking within Security Orchestration and Incident Case Management systems throughout the entire incident lifecycle.

Required Qualifications:

 

• Min 4 years with HS Diploma, 2 years AS/AA degree, 0 years BS degree
• A DoW TS/SCI clearance is required
• Must be DoW 8140 compliant under the Work Role Code 531– Cyber Defense Incident Responder - Basic level or higher.  Must have one of the following below.

 

• CEH(P)
• ECIH
• GRID
• RCCE Level 1
• CBROPS
• CCSP
• CEH
• Cloud+
• FITSP-O
• GCED
• GCIH
• GSEC
• PenTest+
• Security+
• CFR
• CySA+
• GCFA
• GCIA
• GICSP

Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world’s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees do the can’t be done by solving the most daunting challenges facing our customers. Visit peraton.com to learn how we’re keeping people around the world safe and secure.

$66,000 - $106,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual’s experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.

EEO: Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.