Sr. Incident Responder

Location: Onsite – New Carrollton, MD or Memphis, TN

Terms: Full-time

Clearance: Public Trust

Travel: 0% (onsite presence at client facilities as directed)

We are seeking a Sr. Incident Responder to serve as task lead for incident analysis in a 24x7x365 Security Operations Center (SOC) supporting a large federal agency. This seasoned technical contributor analyzes suspected cybersecurity incidents to determine their nature, scope, severity, likely cause, affected assets, operational impact, and recommended response actions, leads the incident responders performing this work, and collaborates with internal experts on deep analyses.

• Lead incident analysis from initial evidence through recommended response.
• Deliver clear, well-supported incident findings and timelines.
• Turn lessons learned into better monitoring, triage, and escalation.
• Guide and develop incident responders.

• Serve as task lead for incident analysis, assigning and reviewing the work of incident responders.
• Analyze suspected incidents to identify relevant activity, affected systems, indicators of compromise, timeline of events, and potential impact.
• Correlate data from logs, alerts, artifacts, reports, threat intelligence, and other approved sources.
• Document analytical findings, confidence levels, supporting evidence, and recommended response or remediation actions in Incident Analysis Reports.
• Coordinate analysis with client IT organizations, other contractors, vendors, and authorized stakeholders as directed.
• Support federal and organizational incident reporting requirements as directed.
• Use incident findings and lessons learned to improve monitoring, triage, escalation, and analysis procedures.

• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related field and 7+ years of relevant professional experience; three (3) years of additional relevant experience may be substituted in lieu of a degree.
• Seasoned technical individual contributor, fully proficient in applying technical principles, theories, and concepts in the field.
• Ability to develop solutions to technical problems and issues that are difficult, unclear, and require deep technical knowledge.
• Deep understanding of the principles, theories, and concepts of the technical domain, with broad understanding of related specialty areas.
• Experience performing in-depth incident analysis in large enterprise environments, including log analysis and IOC correlation.
• Expertise with SIEM, EDR, and network security monitoring tools.
• Working knowledge of NIST SP 800-61 and the MITRE ATT&CK framework.
• Experience supporting federal government contracts as a contractor, including working to contract performance standards, deliverable schedules, and government review and approval processes.
• Certifications such as GCIH, GCIA, GCFA, or CISSP.
• Experience analyzing incidents in AWS and Microsoft Azure/M365 environments.
• Experience with SOAR playbooks and automation.

Work Authorization/Clearance: Must be a U.S. Citizen and able to obtain a Public Trust clearance.