Overview Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world’s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees do the can’t be done by solving the most daunting challenges facing our customers. Visitperaton.comto learn how we’re keeping people around the world safe and secure. Responsibilities Peraton is seeking to hire an experiencedSenior Cyber Incident Handling Analystfor its’ Regional Cyber Center-Europe programLocation: On-site, Wiesbaden, GermanyResponsibilities:Manage the full cyber incident lifecycle - from initial detection and triage through containment, eradication, recovery, and post-incident review - ensuring all actions are executed in accordance with NIST SP 800-61 and Army incident response proceduresCoordinate with internal RCC-E teams, supported unit commanders, NETCOM, and ARCYBER during active cyber incidents, serving as the primary point of contact for incident status updates and ensuring timely, accurate communication to all stakeholdersProduce comprehensive incident reports including initial notifications, situation reports (SITREPs), and final after-action reports that document the timeline, scope, impact, root cause, and remediation actions for each cyber incidentMaintain accurate and up-to-date incident tracking records in TheHive and ServiceNow, ensuring all case data, evidence artifacts, analyst notes, and closure documentation meet RCC-E quality standards and audit requirementsConduct post-incident reviews and lessons-learned sessions following significant cyber events, identifying process gaps, detection failures, and response inefficiencies, and translating findings into actionable improvements for the RCC-E CSSPDevelop, maintain, and exercise incident response playbooks for common attack scenarios (ransomware, phishing, credential theft, insider threat), ensuring procedures remain current with the evolving threat landscape and Army policy requirements Qualifications Required:Bachelor’s degree (STEM/Business Admin) and a minimum of 5 years of cyber incident handling and security operations experience, or an associates degree and a minimum of 7 years of relevant experience, or 11 years of relevant experience in lieu of the bachelor’s degreeMust meet TESA QualificationDoW 8140 - Cybersecurity (Cyber Defense Incident Responder) - IntermediateCertifications - must hold active certifications (one of the following):Cisco CyberOps ProfessionalGCED (GIAC Certified Enterprise Defender)GCIH (GIAC Certified Incident Handler)GCFA (GIAC Certified Forensic Analyst)GCFE (GIAC Certified Forensic Examiner)GMON (GIAC Continuous Monitoring Certification)GNFA (GIAC Network Forensic Analyst)Blue Team Level 2Microsoft Certified: Cybersecurity Architect ExpertDemonstrated experience in IDS/SIEM monitoring, event triage, multi-source data analysis, incident response coordination, TTP and exploit knowledge, and end-to-end incident documentation from detection through resolutionU.S. citizenship requiredActive DoW TS/SCI security clearancePreferred:Hands-on experience with TheHive for structured incident case management, evidence tracking, and analyst workflow coordinationFamiliarity with MISP for threat intelligence sharing, IOC management, and integration with incident response workflowsExperience with ServiceNow Security Operations (SecOps) module for incident tracking and SLA managementProficiency with Elastic Stack or Splunk for SIEM-based alert triage, event correlation, and incident timeline reconstructionWorking knowledge of NIST SP 800-61 Computer Security Incident Handling Guide and DoD/Army incident response policy frameworksExperience developing and exercising incident response playbooks for common cyber-attack scenarios in a DoD environmentFamiliarity with digital forensics tools and techniques for evidence collection, chain of custody, and artifact analysisExperience operating in a 24/7 CSSP or SOC environment supporting classified Army or DoW networks