HHS - Incident Responder

cFocus Software seeks a Incident Responder to join our program supporting the Department of Health and Human Services (HHS) This position is remote. This position requires the ability a Public Trust clearance. Qualifications: • Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related field. • Minimum 4–7 years of experience in incident response, SOC operations, or cybersecurity operations. • Hands-on experience responding to enterprise cybersecurity incidents. • Strong understanding of NIST SP 800-61, NIST SP 800-53, and federal incident response requirements. • Experience analyzing logs, alerts, malware, and security events. • Ability to work effectively under pressure during active incidents. • Strong written and verbal communication skills. • Active GCIH, CISSP, CEH, or Security+ (preferred). Duties: • Monitor, triage, and respond to cybersecurity alerts and incidents in accordance with HRSA Incident Response Plans and SOC SOPs. • Perform incident analysis to determine scope, impact, root cause, and affected systems. • Execute containment, eradication, and recovery actions for cybersecurity incidents. • Respond to malware infections, phishing campaigns, ransomware, insider threats, and data breaches. • Collect, preserve, and analyze evidence in accordance with chain-of-custody requirements. • Support forensic analysis and coordinate with digital forensics and threat hunting teams. • Document incident activities, timelines, findings, and remediation actions within defined SLAs. • Prepare incident reports, notifications, and after-action reports for HRSA and HHS stakeholders. • Coordinate incident response activities with SOC Analysts, ISSOs, system owners, Privacy Officials, and leadership. • Support reporting requirements to HHS CSIRC, CISA, and other federal entities as required. • Participate in incident response drills, tabletop exercises, and cyber exercises. • Support continuous improvement of incident response playbooks, SOPs, and workflows. • Assist with remediation validation and lessons-learned activities following incident closure. Apply tot his job