Cyber Incident Manager Security Clearance

Position: Cyber Incident Manager with Security Clearance
Job Title:

Cyber Incident Manager

Location:

Arlington, VA (On-Site) Clearance:
Active TS/SCI Required Company:
Quantum Science Solutions (QSS) Compensation:
Open Rate

Position Overview Quantum Science Solutions (QSS) is seeking an experienced Cyber Incident Manager to support mission-critical cybersecurity operations through incident triage, analysis, documentation, coordination, and resolution. This role is responsible for managing Computer Network Defense (CND) incidents from initial detection through final resolution while supporting enterprise cyber defense activities and incident reporting requirements. The selected candidate will analyze network alerts, correlate incident data, identify trends, determine incident scope and urgency, and coordinate with internal teams to support timely mitigation and response.

This position requires strong knowledge of incident response methodologies, cybersecurity operations, attack stages, vulnerability categories, and Federal incident reporting standards.

Key Responsibilities
• Perform Computer Network Defense incident triage to determine incident scope, urgency, severity, and potential enterprise impact.
• Receive, review, and analyze network alerts from multiple enterprise sources to determine possible causes and required response actions.
• Correlate incident data to identify trends, recurring issues, and patterns in reported cybersecurity incidents.
• Track and document CND incidents from initial detection through final resolution.
• Coordinate with internal components and stakeholders to gather information related to ongoing incidents.
• Research and compile known resolution steps, workarounds, and mitigation actions to support incident response efforts.
• Apply cybersecurity concepts to detect, analyze, and defend against intrusions across small and large-scale IT networks.
• Conduct cursory analysis of log data to identify potential indicators of compromise or suspicious activity.
• Monitor external data sources to maintain awareness of current CND threat conditions and assess potential enterprise impact.
• Identify incident causes and determine key information needed from external entities regarding infection vectors and background details.
• Prioritize incidents and support escalation to specialized analysts when advanced investigation is required.
• Analyze phishing-related activity and describe tactics, techniques, and indicators associated with phishing campaigns.
• Recognize gaps in incident reporting and recommend improvements to support accurate and complete documentation.
• Recommend defense-in-depth principles and practices, including layered defenses, security robustness, and defense in multiple places.
• Support shift-based cyber operations, incident triage, IOC research, and escalation workflows as assigned. Mandatory Skills
• U.S. Citizenship.
• Active TS/SCI clearance.
• Ability to obtain DHS Suitability.
• Minimum of 5+ years of directly relevant experience in cyber incident management, incident response, or cybersecurity operations.
• Knowledge of incident response and incident handling methodologies.
• Familiarity with NIST 800-62 and FISMA standards as they relate to incident reporting.
• Ability to prioritize incidents based on scope, urgency, and potential impact.
• Experience investigating and describing tactics used in phishing campaigns.
• Ability to recognize gaps in incident reporting and recommend corrective actions.
• Knowledge of general attack stages, including foot printing, scanning, enumeration, gaining access, privilege escalation, maintaining access, network exploitation, and covering tracks.
• Skill in recognizing and categorizing vulnerabilities and associated attack types.
• Knowledge of basic system administration and operating system hardening techniques.
• Knowledge of Computer Network Defense policies, procedures, and regulations.
• Knowledge of operational threat environments, including non-nation-state and nationstate sponsored threats.
• Knowledge of system and application security threats and attack methods, including buffer overflow, mobile code, cross-site scripting, PL/SQL and injection attacks,…