Cyber Defense Incident Responder - Overnight ShiftCyber Defense Incident Responder - Overnight Shift

ASRC Federal•Quantico, VA

23h•Onsite

About The Position

ASRC Federal is seeking a skilled Cyber Incident Responder to provide overnight coverage at DCSA facilities on Quantico Marine Corps Base, Virginia. This is a fully on-site position with no telework. The role provides extended-hours coverage, including weekend and holiday rotations, and supports Department of Defense missions by detecting, triaging, containing, and eradicating threats across enterprise infrastructure while minimizing incident impact and preserving forensic evidence. The responder executes the incident-response lifecycle during overnight, weekend, and holiday coverage windows. Using enterprise tools such as SIEM, SOAR, CrowdStrike, CyberArk, and Endpoint Security Suite (ESS), the responder conducts response actions, coordinates recovery, supports insider-threat investigations, and works with cross-functional IT and security teams. The position also handles JFHQ-DODIN cyber tasks and incident reporting, maintains playbooks and case documentation, and communicates incident findings and trends to leadership. The schedule consists of four 10-hour shifts per work week, assigned from 2100 to 0700.

Requirements

At least two years of hands-on technical cybersecurity experience.
Knowledge of incident-response concepts, Computer Network Defense, DISA Security Technical Implementation Guides (STIGs), the DoD A&A Process, NIST SP 800-53, NIST SP 800-61, CJCSM 6510.01B, U.S. Cyber Command guidelines, and applicable DoD cybersecurity and Computer Network Defense policies.
Active Top Secret clearance, with eligibility to be upgraded to TS/SCI.
Bachelor’s degree in Information Technology, Information Systems Management, Cyber Security, or equivalent experience.
Meet DoD 8570 IAT Level II certification requirements at time of hire.
Ability to communicate complex technical ideas verbally and in writing to a diverse customer base.
Ability to work the assigned overnight shift, 2100–0700, and support scheduled weekend and holiday coverage.

Nice To Haves

CSIH, GCIH, or GCFA certification for incident handling.

Responsibilities

Monitor security alerts and events from SIEM, EDR, IDS/IPS, firewall, DNS, and ESS sources to detect, triage, and prioritize potential incidents.
Execute the incident-response lifecycle, including preparation, detection and analysis, containment, eradication, recovery, and post-incident activity, in accordance with NIST SP 800-61.
Contain and remediate compromised endpoints, accounts, and systems.
Process JFHQ-DODIN cyber-related tasks, orders, and incident-reporting requirements within required timelines.
Investigate potential cybercrime and malware incidents, examine computers, and preserve forensic evidence following chain-of-custody procedures.
Use forensic tools and investigative methods to identify, isolate, and analyze electronic data associated with complex malware infections.
Develop and maintain incident-response playbooks, standard operating procedures, and detailed incident case documentation.
Provide timely incident reports and escalations to senior leadership, and deliver daily, weekly, and monthly summaries of incident trends and network-security indicators.
Coordinate incident-response actions with cross-functional IT and security teams and support insider-threat response and investigations.
Support weekend and holiday coverage as scheduled.