Perform advanced incident response across Windows and Linux environments, including triage, containment, eradication, and recovery.
Conduct host-based forensics, including log analysis, memory capture, file system review, and malware behavior analysis.
Serve as Incident Commander during cybersecurity events, coordinating actions, documenting decisions, and communicating with leadership and affected agencies.
Analyze adversary Tactics, Techniques, and Procedures (TTPs) and map findings to MITRE ATT&CK.
Review and validate alerts from SIEM, IDS/IPS, EDR, and network monitoring tools.
Produce incident reports, timelines, and executive summaries for statewide stakeholders.
Support multi-agency response operations, including SLTT partners and critical infrastructure entities.
Provide recommendations for detection improvements, hardening, and long-term mitigation.
Participate in post-incident reviews, lessons learned, and playbook updates.
Maintain readiness for 24x7 response through on-call rotation or surge support.

\nCandidate must be a U.S. citizen, pass required background checks, complete required cybersecurity, privacy, and operational training before gaining system access, and comply with TXCC security and data-handling requirements. Occasional after-hours support may be required with TXCC approval. Work must be performed from within the United States unless TXCC grants prior written approval.
\nThe working position is Hybrid - On Site and Telework.
\n \n\n\t\n\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\n

Minimum Requirements: Candidates that do not meet or exceed the minimum stated requirements (skills/experience) will be displayed to customers but may not be chosen for this opportunity.
Actual \n\t\t\tYears \n\t\t\tExperience	Years \n\t\t\tExperience \n\t\t\tNeeded	Required/ \n\t\t\tPreferred	Skills/Experience
	5	Required	Advanced host‑based forensics across Windows and Linux, including memory, disk, and malware analysis, using telemetry from NetWitness, Gravwell, Google SecOps, and Corelight to validate findings and reconstruct attacker activity.
	5	Required	Ability to correlate host, network, and intelligence data from CrowdStrike, SentinelOne, Microsoft Sentinel, Corelight, and NetWitness to build complete incident timelines.
	5	Required	Experience producing high‑quality incident reports and executive summaries using evidence collected from Gravwell, NetWitness, Corelight, and case management workflows.
	4	Required	Strong understanding of adversary TTPs, intrusion kill chains, and threat hunting methodologies using packet‑level and log‑level data from but not limited to Corelight, NetWitness, and CRIBL pipelines.
	3	Required	Incident Commander experience
	1	Required	Experience supporting SLTT or critical infrastructure environments, including multi‑tenant IR operations and cross‑agency coordination.
	5	Preferred	Proficiency with threat intelligence platforms, including Recorded Future, ThreatMon, GreyNoise, Google Threat Intelligence, VirusTotal, and Mandiant, to enrich investigations, validate indicators, and map activity to MITRE ATT&CK.
	5	Preferred	Hands‑on experience using Cyware CSAP for incident orchestration, automated enrichment, case creation, and workflow execution across SIEM, IPS, EDR, and ticketing systems.
	4	Preferred	Security Certifications Preferred (CISSP, CIH, Sec+)

\n
\n
\n
\nI need Three References
\n
\n \n\n\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\n

Reference Name (Required):
Title (Optional)
Company Name (Required):
Phone Number (Required include area code):
E-mail address (Optional):
Professional Relationship (Optional):

Reference Name (Required):
Title (Optional)
Company Name (Required):
Phone Number (Required include area code):
E-mail address (Optional):
Professional Relationship (Optional):

Reference Name (Required):
Title (Optional)
Company Name (Required):
Phone Number (Required include area code):
E-mail address (Optional):
Professional Relationship (Optional):

\n \n\n\t\n\t\t\n\t\t\t\n\t\t\t \n\t\t\t\n\t\t\n\t\n\n \n\n\t\n\t\t\n\t\t\t\n\t\t\t \n\t\t\t\n\t\t\n\t\n\n \n\n\t\n\t\t\n\t\t\t\n\t\t\t \n\t\t\t\n\t\t\n\t\n\n
\nPeer Co-Worker Supervisor
\n \n\n\t\n\t\t\n\t\t\t\n\t\t\t \n\t\t\t\n\t\t\n\t\n\n \n\n\t\n\t\t\n\t\t\t\n\t\t\t \n\t\t\t\n\t\t\n\t\n\n
\n
\n \n\n\t\n\t\t\n\t\t\t\n\t\t\t \n\t\t\t\n\t\t\n\t\n\n Customer End-User Subordinate
\n
\n ",["D",1783353195504],"formBundle",{"_405":406,"_75":407},"formBundleId","a534941b2893a73e5314430637ec8f12d0280beb",[408,413,424,429,434,439,446,449,452,456],{"_56":409,"_410":61,"_411":412},"break","breakType","title","* - indicates a required field",{"_10":414,"_56":415,"_416":15,"_417":418,"_419":420,"_421":422,"_423":13},"8wruab2idy9","file","comment","fieldId","2048390","mapping","resume","question","Upload Resume","required",{"_10":425,"_56":25,"_416":15,"_417":426,"_419":427,"_421":428,"_423":13},"iusehr4hap","2048393","firstname","First Name",{"_10":430,"_56":25,"_416":15,"_417":431,"_419":432,"_421":433,"_423":13},"io37nrdf5wg","2048396","lastname","Last Name",{"_10":435,"_56":25,"_416":15,"_417":436,"_419":437,"_421":438,"_423":13},"5ykkodhe72l","2048399","email","Email",{"_10":440,"_56":441,"_416":15,"_417":442,"_419":443,"_421":444,"_423":445},"4ugfx27x9hm","textarea","2048402","street","Address",false,{"_10":447,"_56":25,"_416":15,"_417":448,"_419":136,"_421":137,"_423":445},"qdgy0b49e5","2048405",{"_10":450,"_56":25,"_416":15,"_417":451,"_419":138,"_421":139,"_423":445},"n93t2gyd6v","2048408",{"_10":453,"_56":25,"_416":15,"_417":454,"_419":455,"_421":290,"_423":445},"6liomj8j05e","2048411","postalcode",{"_10":457,"_56":25,"_416":15,"_417":458,"_419":459,"_421":460,"_423":445},"6ns2mdubjjv","2048414","phone-secondary","Phone","stateCode","countryCode",{"_319":320,"_136":317,"_138":318,"_293":327,"_328":259,"_66":329,"_330":331},"actionData","errors"]