Incident Response Lead

The Incident Response Shift Lead is a senior analyst responsible for real-time monitoring, triage, incident intake, investigation, coordinated response, shift execution, and analyst mentoring. The role leads an assigned shift, manages urgent technical work, maintains clear operational handoffs, and develops defensible conclusions from incomplete or ambiguous evidence across on-premises and cloud environments.

• Lead an assigned SOC shift and coordinate monitoring, triage, incident intake, investigation, escalation, and response activities.
• Monitor alerts, logs, events, and security data for anomalous or malicious activity and determine severity, impact, and required escalation.
• Receive, review, document, and coordinate suspicious-activity and incident reports from authorized internal and external sources.
• Perform incident analysis to identify relevant activity, affected systems, indicators of compromise, event timelines, likely cause, severity, scope, and operational impact.
• Correlate alerts, logs, endpoint data, network data, cloud telemetry, threat intelligence, artifacts, and prior cases to develop defensible findings.
• Document evidence, confidence levels, analytical judgments, unresolved questions, and recommended response or remediation actions.
• Recommend and support containment, eradication, recovery, and post-incident improvement activities with system and service owners.
• Create, update, and maintain accurate incident records and support closure only after required remediation, coordination, and documentation are complete.
• Conduct disciplined shift handoffs covering open incidents, pending notifications, degraded tools or feeds, approvals, risks, and deadline-sensitive actions.
• Operate and troubleshoot assigned SOC tools and escalation platform or engineering problems through the designated technical lead.
• Mentor junior analysts, review work products, reinforce procedures, and contribute to lessons learned and playbook improvements.
• Participate in exercises, continuity activities, and surge operations as assigned.

• Seven or more years of cybersecurity experience, including substantial hands-on SOC, incident-response, cyber-defense, or threat-analysis work.
• Demonstrated ability to solve difficult or unclear technical problems through deep analysis and collaboration with internal experts.
• Hands-on experience with enterprise SIEM, endpoint security, network-security monitoring, and case-management technologies.
• Strong incident documentation and briefing skills, including the ability to distinguish facts, interpretations, and unresolved questions.
• Ability to work an assigned 24x7 shift and support after-hours coverage as required.

• Five or more years in a 24x7 SOC or incident response center, including experience as a shift lead or senior analyst.
• Experience investigating incidents across on-premises, AWS, Azure, Microsoft 365, identity, endpoint, and network environments.
• GCIH, GCIA, GCFA, CySA+, CEH, Security+, or comparable role-aligned cybersecurity certifications preferred.
• Working knowledge of widely used incident-response and federal incident-notification guidance.
• Demonstrated ability to communicate clearly with technical and customer leads during high-priority events.

• Alerts and incident reports receive timely, consistent, evidence-based triage and escalation.
• Investigations produce clear timelines, scope, impact, findings, and recommended actions.
• Shift handoffs preserve continuity and leave no ambiguity about ownership, status, and next action.
• Junior analysts improve through direct coaching, quality review, and practical operational guidance.

• Minimum:
  Bachelor's degree in cybersecurity, computer science, information systems, engineering, or a related field; additional relevant experience may be considered in lieu of a degree.

• Secret clearance preferred but not required.

• Hybrid federal customer environment. Regular onsite presence and periodic travel between supported operating locations may be required.

• Assigned 24x7 SOC shift, which may include days, nights, weekends, and holidays. Participation in on-call and non-regular-duty coverage may be required.
• Ability to pass a minimum background investigation.