Cyber Incident Responder (24x7 Days)

ASRC Federal•Quantico, VA

6d•Onsite

About The Position

ASRC Federal is seeking a highly skilled and experienced Cyber Incident Responder to join our dynamic team on the day shift (0600 – 1600), providing extended-hours coverage that includes weekend and holiday rotations. This is a fully on-site position at Quantico Marine Corps Base, VA — no telework is available for this role. The successful candidate will serve as a front-line defender, rapidly detecting, triaging, containing, and eradicating cyber threats across our enterprise infrastructure. This role is critical for minimizing the impact of security incidents, coordinating response actions, and preserving forensic evidence in support of Department of Defense (DoD) missions. The Cyber Incident Responder is a vital role responsible for executing the full incident response lifecycle during day shift, weekend, and holiday coverage windows. This position focuses on detecting and responding to security incidents in real time, performing containment and eradication actions, and coordinating recovery efforts using enterprise tools such as SIEM, SOAR, CrowdStrike, CyberArk, and Endpoint Security Suite (ESS). The Incident Responder will collaborate with cross-functional IT and security teams to: * Execute incident response procedures in accordance with NIST SP 800-61 and DoD guidelines * Coordinate with JFHQ-DODIN on cyber incident reporting and remediation * Support insider threat response and investigations * Contain and remediate compromised systems, accounts, and endpoints * Preserve and document forensic evidence for incident case management * Maintain incident response playbooks and ensure high operational readiness during all covered hours

Requirements

At least Five (5) years of hands-on technical cybersecurity experience and knowledge of incident response concepts, Computer Network Defense, DISA Security Technical Implementation Guides (STIGs), DoD A&A Process, NIST SP 800-53, NIST SP 800-61, CJCSM 6510.01B, United States Cyber Command guidelines, and other applicable DoD Cyber Security and Computer Network Defense policies.
Active Top-Secret Clearance REQUIRED, eligible to be upgraded to TS/SCI.
Bachelor’s degree in Information Technology, Information Systems Management, Cyber Security, or equivalent experience.
Must meet DoD 8570 certification requirements at time of hire — IAT Level II (e.g., CCNA Security, CySA+, GICSP, GSEC, Security+, SSCP); CSIH, GCIH, or GCFA preferred for incident handling.
Willingness and availability to work the day shift (0600 – 1600), including weekend and holiday rotations, fully on-site at Quantico, VA.
Knowledge of computer network defense concepts, DISA Security Technical Information Guides, DoD A&A Process, NIST SP 800-53, NIST SP 800-61, CJCSM 6510.01 B, United States Cyber Command guidelines, and other applicable DoD Cybersecurity and Computer Network Defense Policies

Nice To Haves

CSIH, GCIH, or GCFA preferred for incident handling.

Responsibilities

Execute incident response procedures in accordance with NIST SP 800-61 and DoD guidelines
Coordinate with JFHQ-DODIN on cyber incident reporting and remediation
Support insider threat response and investigations
Contain and remediate compromised systems, accounts, and endpoints
Preserve and document forensic evidence for incident case management
Maintain incident response playbooks and ensure high operational readiness during all covered hours
Provide continuous monitoring, data to include but not limited to network and host vulnerability scanning IDS, firewall, network sensor tuning, net flow/packet capture (PCAP).
Collect and keep audit data in order to conduct a technical analysis relating to misuse, penetration, or other incidents.
Document incidents, response actions, and remediation recommendations in accordance with government reporting requirements.
Monitor multiple environments for malicious or anomalous activity using SIEM, SOAR, and on-prem security tooling.
Analyze logs, telemetry, alerts, and audit data to identify indicators of compromise (IOCs) and attack patterns.
Develop, maintain, and provide a weekly brief that captures all the cyber events including metrics and trends.