Cyber Defense Incident Responder

ASRC Federal•Quantico, VA

4d•Onsite

About The Position

ASRC Federal is seeking a highly skilled and experienced Cyber Incident Responder to join our dynamic team on the swing shift (1400 – 0000), providing extended-hours coverage that includes weekend and holiday rotations. This is a fully on-site position at Quantico Marine Corps Base, VA — no telework is available for this role. The successful candidate will serve as a front-line defender, rapidly detecting, triaging, containing, and eradicating cyber threats across our enterprise infrastructure. This role is critical for minimizing the impact of security incidents, coordinating response actions, and preserving forensic evidence in support of Department of Defense (DoD) missions. The Cyber Incident Responder is a vital role responsible for executing the full incident response lifecycle during swing-shift, weekend, and holiday coverage windows. This position focuses on detecting and responding to security incidents in real time, performing containment and eradication actions, and coordinating recovery efforts using enterprise tools such as SIEM, SOAR, CrowdStrike, CyberArk, and Endpoint Security Suite (ESS). The Incident Responder will collaborate with cross-functional IT and security teams to: Execute incident response procedures in accordance with NIST SP 800-61 and DoD guidelines Coordinate with JFHQ-DODIN on cyber incident reporting and remediation Support insider threat response and investigations Contain and remediate compromised systems, accounts, and endpoints Preserve and document forensic evidence for incident case management Maintain incident response playbooks and ensure high operational readiness during all covered hours

Requirements

At least Two (2) years of hands-on technical cybersecurity experience and knowledge of incident response concepts, Computer Network Defense, DISA Security Technical Implementation Guides (STIGs), DoD A&A Process, NIST SP 800-53, NIST SP 800-61, CJCSM 6510.01B, United States Cyber Command guidelines, and other applicable DoD Cyber Security and Computer Network Defense policies.
Active Top Secret Clearance REQUIRED, eligible to be upgraded to TS/SCI.
Bachelor’s degree in Information Technology, Information Systems Management, Cyber Security, or equivalent experience.
Must meet DoD 8570 certification requirements at time of hire — IAT Level II (e.g., CCNA Security, CySA+, GICSP, GSEC, Security+, SSCP); CSIH, GCIH, or GCFA preferred for incident handling.
Willingness and availability to work the swing shift (1400 – 0000), including weekend and holiday rotations, fully on-site at Quantico, VA.

Nice To Haves

CSIH, GCIH, or GCFA preferred for incident handling.

Responsibilities

Monitor security alerts and events from SIEM, EDR, IDS/IPS, firewall, DNS, and ESS sources to rapidly detect, triage, and prioritize potential security incidents.
Execute the full incident response lifecycle — preparation, detection and analysis, containment, eradication, recovery, and post-incident activity — in accordance with NIST SP 800-61.
Take decisive containment and eradication actions on compromised endpoints, accounts, and systems to limit incident impact.
Process and handle JFHQ-DODIN cyber-related tasks, orders, and incident reporting requirements to completion within required timelines.
Identify evidence of illegal activity involving cybercrime offenses; examine computers potentially involved in crime or malware infection and preserve forensic evidence following chain-of-custody procedures.
Use forensic tools and investigative methods to identify, isolate, and analyze specific electronic data associated with complex malware infections.
Develop and maintain incident response playbooks, standard operating procedures (SOPs), and detailed incident case documentation.
Provide timely incident reports and escalations to senior leadership and deliver daily/weekly/monthly summaries on incident trends and key indicators of network security.