Incident Handler/Security Analyst – 3rd shift

Job Summary

GovCIO is seeking an Incident Handler/Security Analyst for a 3rd‑shift (11 pm – 7:30 am) role supporting the U.S. Courts in Washington, D.C. This hybrid position requires four days on‑site and one remote day per week.

Key Responsibilities

• Correlate threat data from multiple feeds to identify attackers, their tactics, techniques, and procedures (TTPs).
• Perform real‑time monitoring, triage, and containment of security incidents across federal court networks.
• Develop and deliver detailed incident reports, root‑cause analyses, and actionable remediation recommendations to stakeholders.
• Collaborate with the client’s IT and legal teams to ensure compliance with Public Trust and Suitability requirements.
• Maintain and improve incident response playbooks, detection rules, and forensic tooling.
• Provide after‑hours on‑call support and participate in on‑call rotation for the 3rd shift.
• Conduct threat‑intel briefings and share findings with the broader security operations center.

Required Qualifications

• Minimum 3 years of experience in incident handling, security operations, or cyber threat analysis.
• Strong knowledge of networking protocols, Windows/Linux systems, and common attack vectors.
• Hands‑on experience with SIEM platforms (e.g., Splunk, QRadar) and forensic tools (e.g., EnCase, FTK).
• Ability to obtain and maintain a Public Trust/Suitability clearance.
• Excellent written and verbal communication skills for reporting to technical and non‑technical audiences.

Preferred Skills

• Relevant certifications such as GSEC, GCFA, or CISSP.
• Experience supporting federal agencies, particularly the U.S. Courts.
• Knowledge of MITRE ATT&CK framework and threat‑intel platforms.

Compensation & Benefits

Salary: $108,571.61 annually (fixed). Comprehensive federal‑aligned benefits package, including health, dental, vision, 401(k) match, and paid time off.

Frequently Asked Questions

What are the typical work hours for this Incident Handler role?

The position is a 3rd‑shift schedule from 11 pm to 7:30 am, four days on‑site in Washington, D.C., with Fridays working remotely.

Do I need a security clearance for this job?

Yes, candidates must be able to obtain and maintain a Public Trust/Suitability clearance to work with the U.S. Courts.

What experience is required to be considered for this role?

At least three years of hands‑on incident handling or security operations experience, familiarity with SIEM and forensic tools, and strong networking knowledge.