Incident Commander (Tier 3)

Accountabilities: Advanced Incident Response: Lead Tier 3 investigations into complex cybersecurity incidents, including malware infections, phishing campaigns, ransomware attacks, social engineering, data exposure, and other security threats. Analyze attack vectors, adversary behavior, and indicators of compromise to determine incident severity, scope, and potential impact. Incident Command & Coordination: Serve as the primary operational coordinator during significant security incidents, assigning response actions and coordinating enterprise teams, incident responders, stakeholders, resources, and timelines to ensure effective resolution. Security Monitoring & Threat Analysis: Review escalated security alerts and analyze events using Splunk SIEM and other security platforms. Perform advanced incident triage, distinguish genuine threats from false positives, and determine appropriate containment, investigation, or escalation measures. Containment & Recovery: Coordinate incident containment, remediation, and recovery activities to minimize operational disruption, mitigate risks, and restore affected systems and services. Incident Documentation & Reporting: Create, maintain, and track incident records throughout the investigation lifecycle, ensuring accurate documentation and compliance with applicable federal requirements, organizational policies, and reporting procedures. Forensic Investigation & Threat Hunting: Collaborate with digital forensic investigators and application security specialists to conduct endpoint, network, and log analysis, identify indicators of compromise, establish incident scope, and support root-cause investigations. Security Improvement & Risk Management: Evaluate and recommend technical, procedural, and physical security controls to address vulnerabilities, reduce incident impact, and prevent recurrence. Stakeholder Communication: Prepare incident notifications, executive briefings, status updates, and post-incident reports covering investigation findings, response actions, remediation progress, recovery activities, and lessons learned. Operational Compliance: Ensure adherence to established standard operating procedures, escalation protocols, security policies, and applicable regulatory requirements, including timely incident notifications to federal leadership. Requirements Professional Experience: At least 7 years of relevant professional experience, or a bachelor's degree combined with at least 3 years of relevant experience. Citizenship & Security Eligibility: U.S. citizenship is mandatory due to federal contract requirements. Candidates must be able to successfully complete a federal background investigation for a High-Risk Public Trust position, including applicable credit checks, and obtain and maintain the required Public Trust. Mandatory Certifications: An active CISSP certification from ISC2, together with an active GCIH certification from GIAC or an equivalent relevant certification in incident response, digital forensics, or cybersecurity, is required. Incident Response Expertise: Extensive experience managing cybersecurity incidents, conducting advanced incident triage, coordinating investigations, and leading response activities through resolution. Security Operations: Strong experience in Security Operations Center (SOC) operations, threat hunting, intrusion detection and prevention, security event monitoring, and incident detection and response. Security Tools & Technologies: Working knowledge of Splunk SIEM, Microsoft Defender EDR, Palo Alto Networks Cortex XSOAR, and digital forensic and incident response tools. Experience with FireEye products and other enterprise security solutions is also valuable. Networking & Systems Knowledge: Expert understanding of TCP/IP protocols, network traffic analysis, IDS/IPS technologies, security log correlation, Windows and Unix/Linux operating systems, enterprise networking, system administration, and operating system hardening. Endpoint & Infrastructure Security: Experience with endpoint protection, antivirus solutions, EDR, host-based intrusion detection, firewalls, proxies, web application firewalls, and cloud security data collection. Digital Forensics: Knowledge of evidence collection, preservation, recovery, chain of custody, forensic imaging, and the analysis of system logs and other investigative artifacts. Threat Intelligence: Strong understanding of cyberattack stages, adversary tactics and techniques, threat profiling, intrusion detection methodologies, and indicators of compromise. Compliance & Governance: Familiarity with cybersecurity frameworks, Computer Network Defense (CND) policies, and regulatory standards such as FISMA, PCI DSS, GDPR, NIST, and ISO. Communication & Leadership: Excellent written and verbal communication, presentation, facilitation, and organizational skills, with the ability to explain complex technical findings and recommended actions to technical teams, senior executives, federal stakeholders, and non-technical audiences. Personal Attributes: Strong analytical judgment, problem-solving capabilities, attention to detail, and the ability to coordinate multiple investigations, manage competing priorities, and make sound decisions in high-pressure situations. Benefits Remote Work: 100% remote working arrangement within the United States. Medical Coverage: Choice of medical insurance plans, including HSA-compatible options and comprehensive PPO coverage, with generous employer contributions. Dental & Vision: Insurance coverage options for employees and their families. Life & Disability Insurance: Company-paid life insurance, short-term disability, and long-term disability coverage. Additional Protection: Optional supplemental life, accident, and critical illness insurance. Retirement Planning: 401(k) retirement savings plan with employer matching. Paid Time Off: Paid leave that increases with years of service, plus paid federal holidays. Professional Development: Paid industry certifications, career development opportunities, and access to an internal training and learning platform. Wellness Programs: Flexible spending accounts and wellness and fitness initiatives. Employee Referral Program: Referral bonuses for successfully recommending qualified candidates. Career Growth: Opportunities to work on high-impact cybersecurity and national security initiatives alongside experienced professionals.