Jobs in the United States

25+ jobs

Save this search

Added 9 mins ago
AI Operations Administrator - Gravitee - Remote US
SitusAMC
Pierre, SD
…environments, organizations, gateways, management console, developer portal, users, groups, and role-based…
Added 9 mins ago
C
AI Data Engineer
Cognizant
Pierre, SD
- $100,000 to $115,000 USD / year
Build production-grade Python applications, scripts, and AWS Lambda functions that integrate with enterprise platforms, APIs, and AWS services.
Added 9 mins ago
GA
Sr Staff Applications Operations Engineer – Engineering Tools Automation & AI Ops
GE Aerospace
Pierre, SD
- $131,000 to $174,000 USD / year
Automation and CI/CD experience (Python, Bash, PowerShell, Jenkins, Artifactory, Ansible) and ITSM tools such as ServiceNow.
Added 9 mins ago
C
AI Data Engineer
Cognizant
Pierre, SD
- $100,000 to $115,000 USD / year
Build production-grade Python applications, scripts, and AWS Lambda functions that integrate with enterprise platforms, APIs, and AWS services.
Added 9 mins ago
EG
Cloud Engineer
Eliassen Group
Pierre, SD
- $70 to $88 USD / hour
…with conversions and decommissioning. The role will support automation efforts and platform build work using GCP, Go, and Temporal for orchestration, and Azure with Terraform and Python.…
Added 22 mins ago
Cloud Migration Associate Engineer / Cloud Migration Developer
Computer Task Group, Inc
Dallas, TX
CTG is seeking to fill a Cloud Migration Associate Engineer / Cloud Migration Developer position for our client.
Added 1 hour ago
AVP Growth Analytics
Unum Group
Portland, ME
…leadership, and the ability to leverage advanced analytics, AI, automation, and emerging technologies to advance analytics delivery and improve business…
Added 1 hour ago
EG
Cloud Engineer
Eliassen Group
Augusta, ME
- $70 to $88 USD / hour
…with conversions and decommissioning. The role will support automation efforts and platform build work using GCP, Go, and Temporal for orchestration, and Azure with Terraform and Python.…
Added 1 hour ago
Corporate Sales Engineer, Customer Sales (Remote)
CrowdStrike
Jefferson City, MO
+ Understanding of AI/ML concepts as they apply to threat detection, anomaly detection, or security automation - ability to speak credibly to both skeptics and enthusiasts
Added 1 hour ago
EG
Cloud Engineer
Eliassen Group
Helena, MT
- $70 to $88 USD / hour
…with conversions and decommissioning. The role will support automation efforts and platform build work using GCP, Go, and Temporal for orchestration, and Azure with Terraform and Python.…
Added 1 hour ago
Software Developer – Entry Level
CGI Technologies and Solutions, Inc.
Lafayette, LA
As an Entry Level Software Developer, you’ll work with cross functional teams to design, build, test, and enhance technology solutions that address client needs. You’ll gain hands‑on…
Added 1 hour ago
EG
Cloud Engineer
Eliassen Group
Baton Rouge, LA
- $70 to $88 USD / hour
…with conversions and decommissioning. The role will support automation efforts and platform build work using GCP, Go, and Temporal for orchestration, and Azure with Terraform and Python.…
Added 1 hour ago
AI Security Engineer, US ADC Security
Amazon.com Services LLC
Jessup, MD · Arlington, VA · Herndon, VA
…research, analyze bug reports, conduct risk assessments, develop automation, maintain documentation, and create tools that reduce security risks. Your work drives secure, reliable AI…
Added 1 hour ago
EG
Cloud Engineer
Eliassen Group
Des Moines, IA
- $70 to $88 USD / hour
…with conversions and decommissioning. The role will support automation efforts and platform build work using GCP, Go, and Temporal for orchestration, and Azure with Terraform and Python.…
Added 1 hour ago
KS
Clinical Data Manager II
Kelly Services
Oro Valley, AZ
- $40 to $55 USD / hour
Technical Scripting: Advanced hands-on proficiency in Python for script automation, data manipulation, and software integration. Familiarity with additional programming languages (e.g.,…
Added 1 hour ago
Principal Infrastructure Engineer - Public Cloud Storage
Wells Fargo
CHANDLER, AZ
Wells Fargo is seeking a Storage Engineer in the Public Cloud Storage space to lead the design, engineering, automation, and adoption of cloud-based storage services with a primary focus on…
Added 1 hour ago
Information Security Engineer Security Baseline Configuration
Wells Fargo
CHANDLER, AZ
Exposure to scripting or automation technologies such as PowerShell, Python, Bash, or similar tools.
Added 1 hour ago
AE
Campus Undergraduate Summer Internship Program - 2027 AI Engineer, Enterprise Technology Services- Phoenix, AZ
American Express
Phoenix, AZ
- $24.05 to $63 USD / hour
In this role, you may support work across machine learning, generative AI, intelligent automation, data pipelines, retrieval patterns, model evaluation, AI agents, agentic workflows, or…
Added 1 hour ago
EG
Cloud Engineer
Eliassen Group
Phoenix, AZ
- $70 to $88 USD / hour
…with conversions and decommissioning. The role will support automation efforts and platform build work using GCP, Go, and Temporal for orchestration, and Azure with Terraform and Python.…
Added 1 hour ago
Senior Platform Engineer
Foresight Works Ltd
NY · New York, NY
Are comfortable writing code in Python, Go or a similar language to build tooling and automation.
Added 1 hour ago
Senior Platform Engineer
Foresight Works Ltd
San Francisco, CA
Are comfortable writing code in Python, Go or a similar language to build tooling and automation.
Added 1 hour ago
GIS Analyst - Schofield Barracks, HI
Colorado State University
Wahiawa, HI
Experience with SQL, Python, Arcade, or other GIS scripting/automation tools.
Added 1 hour ago
Senior Systems Administrator (Linux)
Alaka'ina Foundation Family of Companies
Kaua'i, HI
Proficiency in automation tools and scripting (e.g., PowerShell, Bash, Python)
Added 1 hour ago
EG
Cloud Engineer
Eliassen Group
Honolulu, HI
- $70 to $88 USD / hour
…with conversions and decommissioning. The role will support automation efforts and platform build work using GCP, Go, and Temporal for orchestration, and Azure with Terraform and Python.…
Added 2 hours ago
BA
AVP, SPECIAL PROJECTS
Bayview Asset Management
New York, NY
- $190,000 to $195,000 USD / year
Programming experience in Python (pandas, NumPy, SciPy, scikit-learn) and SQL for financial modeling, automation, data analysis, and large-scale data management.

Phia LLC

Senior Incident Response Analyst (Tier 3 / IR Lead)

United States

Apply About employer

Applications open in a new tab.

Job details

Posting language: English
Posted: Nov 6, 2026

Original job description

Status: Active – Immediate Need Location: Fully remote – U.S. only (no time on the client site expected) Focus Areas: Tier 3 Incident Response, APT/FIN Threat Actor Response, Cloud (AWS) Threat Response, Splunk & Splunk SOAR, Microsoft Defender EDR, and IR Reporting, QA & Mentoring

Overview

At phia we hire talented and passionate people who are focused on collaborative, meaningful work, providing technical and operational subject matter expertise and support services to our partners and clients. phia is seeking a mission-driven Senior Incident Response Analyst to serve as a hands-on responder supporting a federal financial regulatory agency’s cybersecurity operations. You will be the most senior responder on the team: running incidents involving advanced persistent threat (APT) and financially motivated (FIN) actors and cloud-based attacks, mentoring and reviewing the work of fellow analysts, and authoring the clear, defensible reports a demanding client expects. Between incidents the IR team dual-hats as Tier 3 escalation for the SOC. You will work directly with government staff, independently with some guidance, and share a weekly on-call rotation with the rest of the team. What You’ll Do

Respond to Incidents: Triage, investigate, contain, and remediate cybersecurity incidents, applying specific functional IR knowledge to drive them to resolution.
Lead & Mentor: Run incidents end to end as the most senior analyst on the team; review work from junior analysts and give feedback that helps them grow.
Respond to Advanced Actors: Handle and respond to APT and FIN threat actors and cloud-based threats (AWS), from initial detection through eradication and lessons learned.
Work the SOC Stack: Investigate in Splunk (SIEM) and Microsoft Defender EDR, build and tune Splunk SOAR playbooks, pull AWS telemetry, map activity to MITRE ATT&CK, and follow NIST 800-61 incident handling.
Prevent Recurrence: Recommend and implement process improvements with government staff; support auditors when IR processes are reviewed.
Cover On-Call: Participate in the team’s weekly after-hours on-call rotation (approximately one week in six).
Report & Review: Author clear, robust incident reports in Archer (the system of record), track investigations and documentation in GitHub, and perform QA on team member submissions before they go to the client.

Who You Are

Seasoned Responder: 5+ years of hands-on incident response experience.
Threat-Actor Experienced: You have handled an APT or FIN actor and responded to cloud-based threats (AWS or Azure/M365) in an IR capacity.
EDR Fluent: Hands-on with Microsoft Defender EDR (preferred); strong CrowdStrike or SentinelOne responders are considered.
SOC-Minded: Knowledge of SOC best practices and how a Tier 3 / IR team fits into them.
Automation-Minded: You’d rather write a SOAR playbook or a Python parser than click through the same triage twice. Comfortable in Splunk SPL and at a Linux shell.
Client-Ready: Comfortable working directly with clients and government staff - including a demanding one - with a professional demeanor.
Strong Writer: You write clear incident reports and can QA others’ work.
Mentor: You have led or mentored junior analysts and reviewed their work.

Required Qualifications

5+ years of experience with incident response.
Experience handling and responding to an APT or FIN actor and responding to cloud-based threats in an IR capacity.
Experience working directly with clients in a professional demeanor.
Experience with Microsoft Defender EDR (preferred) or an equivalent enterprise EDR such as CrowdStrike or SentinelOne.
Knowledge of SOC best practices.
Ability to work with government staff to suggest and implement process improvements, and to work with auditors to respond to and resolve identified issues in the IR processes.
Ability to author clear and robust reports and to review and ensure QA of team member submissions.
Senior-level Incident Response certification - GIAC GCIH is sufficient; GCFA, GCFR, GNFA, GREM, or EC-Council ECIH also accepted.
Ability to participate in a weekly after-hours on-call rotation.

Preferred Skills

Experience with Splunk (SIEM) and Splunk SOAR, including playbook development.
Experience with GitHub for investigation tracking and documentation.
Experience with Archer (RSA/Archer GRC) as an incident system of record.
Experience responding to incidents in AWS (CloudTrail, GuardDuty, IAM/credential abuse).
Experience mapping activity to MITRE ATT&CK and following NIST 800-61.
Scripting for automation and triage (Python, SPL).
Threat hunting experience.
Ability to review work from junior analysts and provide feedback for growth.

Required Education + Clearance

Education: Bachelor’s Degree required
Certification: Senior-level Incident Response certification - GIAC GCIH is sufficient; GCFA, GCFR, GNFA, GREM, or EC-Council ECIH also accepted.
Clearance: Public Trust / Suitability; applicants selected will be subject to a security investigation.

GENERAL PROGRAM REQUIREMENTS:

Citizenship: Must be a U.S. Citizen.
Work Hours: Expected 8.5-hour workday (with a 30-minute break) within core hours of approximately 7:30 AM – 4:30 PM US Eastern Time (ET), Monday through Friday; daily team meeting at 8:30 AM ET; schedule is flexible with advance notice.
On-Call: Weekly after-hours on-call rotation shared with five other team members (approximately one week in six).
Work Location: Fully remote within the United States; no time on the client site expected.
Travel: Minimal.

Who We Are phia LLC ("phia") is a Northern Virginia based, small business established in 2011 with focus in Cyber Intelligence, Cyber Security/Defense, Intrusion Analysis & Incident Response, Cyber Architecture & Capability Analysis, Cyber Policy & Strategy, Information Assurance/Security, Compliance, Certification & Accreditation, Communications Security, Traditional Security, and Facilities Security. phia also provides cyber operations support functions such as: Program and Process Management, Engineering, Development, and Systems Administration that allows for Cyber Operations to efficiently integrate our customer’s missions and objectives. phia supports various agencies and offices within the Department of Defense (DoD), Federal government, and private/commercial entities.

phia offers excellent benefits to enhance work-life balance, including the following:

Medical Insurance
Dental Insurance
Vision Insurance
Life Insurance
Short Term & Long Term Disability
401k Retirement Savings Plan with Company Match
Paid Holidays
Paid Time Off (PTO)
Tuition and Professional Development Assistance

phia does not discriminate on the basis of race, sex, color, religion, age, national origin, marital status, disability, veteran status, genetic information, sexual orientation, gender identity, or any other reason prohibited by law in the provision of employment opportunities and benefits.

Apply About employer

More about this job

Skills

Incident response
AWS
Splunk
Coaching
Cybersecurity
MITRE ATT&CK
Documentation
GitHub
Microsoft Azure
Microsoft 365
Python
Linux
Identity and access management

Report this job