Incident Response Lead

The Incident Response Lead directs cyber incident handling, investigation, containment, eradication, recovery coordination, and post-incident reporting activities. This role leads operational and analytical response efforts for security incidents and ensures alignment with federal reporting, documentation, and escalation requirements.

• Lead incident response operations for suspected and confirmed cybersecurity events.
• Direct triage, containment, eradication, recovery, and lessons‑learned activities.
• Coordinate with stakeholders, technical teams, leadership, and external parties during incident investigations.
• Oversee incident documentation, timelines, evidence collection, and reporting packages.
• Maintain and refine incident response procedures, playbooks, and escalation workflows.
• Support breach reporting, executive communications, and response quality reviews.
• Guide junior responders and ensure response activities are documented and defensible.

• Bachelor’s degree in cybersecurity, computer science, digital forensics, or related field.
• Minimum 7 years of experience in incident response, cyber defense, or security operations.
• Minimum 3 years in an incident lead, senior analyst, or response coordination role.
• Experience conducting investigations across network, endpoint, log, and cloud data sources.
• Familiarity with federal incident handling standards and reporting expectations.
• Strong decision‑making and crisis communication skills.

• GCIH, GCFA, CISSP, or CISM
• Security+
• Relevant forensic or IR certification

• Ability to obtain and maintain required federal suitability/public trust clearance.
• Ability to support urgent after‑hours incident response activities.