Cyber Defense Incident Responder - Overnight ShiftCyber Defense Incident Responder - Overnight Shift

ASRC Federal•Quantico, VA

1d•$145,000 - $153,656•Onsite

About The Position

ASRC Federal is seeking a Cyber Incident Responder to provide overnight, weekend, and holiday coverage in support of Department of Defense missions. The role detects, triages, contains, and eradicates cyber threats across enterprise infrastructure, coordinates response actions, and preserves forensic evidence. The responder executes the incident response lifecycle in accordance with NIST SP 800-61 and DoD guidelines, coordinates cyber incident reporting and remediation with JFHQ-DODIN, supports insider threat investigations, and maintains incident response playbooks and operational readiness. The position uses enterprise security tools including SIEM, SOAR, CrowdStrike, CyberArk, and Endpoint Security Suite (ESS). This is a fully on-site position at Quantico Marine Corps Base, Virginia, with no telework available. The assigned overnight schedule is 2100–0700, with four 10-hour shifts per work week and weekend and holiday coverage as scheduled.

Requirements

At least two years of hands-on technical cybersecurity experience and knowledge of incident response concepts.
Knowledge of Computer Network Defense, DISA Security Technical Implementation Guides (STIGs), the DoD A&A Process, NIST SP 800-53, NIST SP 800-61, CJCSM 6510.01B, United States Cyber Command guidelines, and applicable DoD cybersecurity and Computer Network Defense policies.
Active Top Secret clearance, with eligibility to be upgraded to TS/SCI.
Bachelor’s degree in Information Technology, Information Systems Management, Cyber Security, or equivalent experience.
Meet DoD 8570 IAT Level II certification requirements at the time of hire; examples include CCNA Security, CySA+, GICSP, GSEC, Security+, or SSCP.
Ability to communicate complex technical ideas verbally and in writing to a diverse customer base.
Ability to work the assigned overnight shift, four 10-hour shifts per work week, and scheduled weekend and holiday coverage.

Nice To Haves

CSIH, GCIH, or GCFA certification for incident handling.

Responsibilities

Monitor SIEM, EDR, IDS/IPS, firewall, DNS, and ESS alerts and events to detect, triage, and prioritize potential security incidents.
Execute the incident response lifecycle, including preparation, detection and analysis, containment, eradication, recovery, and post-incident activity.
Contain and eradicate compromised endpoints, accounts, and systems to limit incident impact.
Process and complete JFHQ-DODIN cyber-related tasks, orders, and incident reporting requirements within required timelines.
Investigate cybercrime and malware incidents, examine potentially involved computers, and preserve forensic evidence using chain-of-custody procedures.
Use forensic tools and investigative methods to identify, isolate, and analyze electronic data associated with complex malware infections.
Develop and maintain incident response playbooks, standard operating procedures, and detailed incident case documentation.
Provide timely incident reports and escalations to senior leadership, and deliver daily, weekly, and monthly summaries on incident trends and network security indicators.
Coordinate incident response and remediation with cross-functional IT and security teams and JFHQ-DODIN.
Support insider threat response and investigations.
Maintain high operational readiness during covered overnight, weekend, and holiday hours.