Incident Commander; Tier 3

Valiant Solutions is seeking an Incident Commander (Tier
3) to join our rapidly growing team!

Named one of the Best Places to Work in the Washington DC area for 12 consecutive years
, Valiant is proud of our employee-centric culture and commitment to excellence. If you are interested in learning more about Valiant and this opportunity,

This position allows for 100% remote work. Remote work requires a high level of trust in our employees, and we strictly adhere to the details outlined in our Remote Work Policy below.

* MUST HAVE one of the following ACTIVE certifications: CISSP (Certified Information Systems Security Professional) certification from ISC2, plus GCIH (GIAC Certified Incident Handler) or an equivalent relevant incident response, digital forensics, or cybersecurity certification.

As cybersecurity incidents exceed the capabilities and scope of Tier 2 operations, the Tier 3 Incident Commander serves as the senior operational lead responsible for coordinating advanced incident response, driving resolution, and ensuring effective communication across stakeholders. The Tier 3 Incident Commander leads a 24x7x365 incident coordination function, responding to escalated alerts, notifications, and incident reports. Responsibilities include establishing and maintaining incident situational awareness, tracking incident progression, coordinating response and remediation activities, facilitating recovery efforts, communicating with stakeholders, and delivering timely, accurate incident reporting.

The role requires the ability to assess complex cybersecurity events, analyze adversary motives, capabilities, and opportunities, and determine the potential impact, scope, and severity of an incident. The Incident Commander ensures that incident reports are accurately documented in the incident tracking system, coordinates with reporting entities to validate information and establish a comprehensive understanding of the event, and identifies additional investigative, containment, remediation, or recovery actions required to achieve resolution.

The Tier 3 Incident Commander must possess extensive knowledge of cybersecurity incident response, anomaly detection and analysis, security log analysis, digital forensics, threat vectors, and adversary tactics and techniques. The individual must be able to interpret technical findings, assess incident reports, exercise sound judgment, and direct or coordinate appropriate response activities based on established procedures and incident requirements. The role also requires strict adherence to standard operating procedures (SOPs), organizational policies, and established escalation, notification, and reporting protocols, including the timely notification and communication of incidents to Federal leadership.

Required technical expertise includes a strong working knowledge of Splunk Security Information and Event Management (SIEM), Microsoft Defender Endpoint Detection and Response (EDR), Palo Alto Networks Cortex XSOAR, and supporting digital forensic and incident response tools.

Required Experience:

• Minimum of 7 years of relevant professional experience, or a bachelor's degree with at least 3 years of relevant experience.
• Must be a U.S. citizen and able to complete a federal background investigation for a High-Risk Public Trust position, including applicable credit checks.
• Must hold CISSP certification from ISC2, plus GCIH (GIAC Certified Incident Handler) or an equivalent relevant incident response, digital forensics, or cybersecurity certification.
• Extensive experience managing cybersecurity incidents, performing advanced incident triage, coordinating response activities, and driving investigations through resolution.
• Demonstrated proficiency in Security Operations Center (SOC) operations, threat hunting, intrusion detection and prevention, security event monitoring, and incident detection and response.
• Expert knowledge of TCP/IP protocols, network traffic analysis, intrusion detection and prevention systems (IDS/IPS), and security log analysis, including the ability to distinguish genuine threats from false positives.
• Experience with endpoint security, antivirus, endpoint detection and response (EDR), host-based intrusion detection, firewalls, proxies, web application firewalls (WAF), and other enterprise security solutions, including Fire Eye products.
• Extensive experience analyzing and correlating security logs from diverse systems and security devices, identifying suspicious…