Cyber Incident Response Team (CIRT) Lead

General Dynamics Information Technology • Falls Church, VA

1d • $136,000 - $184,000 • Onsite

About The Position

GDIT has an opening for a Cyber Incident Response Team (CIRT) Lead supporting the Army National Guard (ARNG). This position is part of an IT Service Management contract that includes the operation, modernization, expansion, and evolution of the ARNG’s global IT services. These services span networking, compute, storage, infrastructure, cybersecurity, applications, hosting, and program management. The program operates within the ITIL framework to deliver high-quality IT services to the ARNG, and this leadership role is critical to ensuring the security and success of that mission.

Requirements

• Active SECRET security clearance required and must be maintained.
• Bachelor’s degree in information technology, computer science, or a related technical discipline; or an equivalent combination of education, technical certifications/training, and relevant work experience.
• 5+ years of practical experience in a cybersecurity, engineering, T&E, or A&A-related field.
• Demonstrated prior experience with cyber incident response on DoW networks and digital forensics.
• Experience in a lead or senior role guiding incident response activities or mentoring junior analysts is strongly preferred.
• Proficiency in collecting and analyzing logs, system images, and other artifacts to investigate and resolve cybersecurity incidents.
• Strong understanding of cybersecurity concepts, mitigation strategies, root cause analysis, and Red Team operations.
• Familiarity with current cyber defense tools and technologies (e.g., SIEM, IDS/IPS, endpoint protection, packet capture tools).
• Excellent oral and written communication skills for both technical and non-technical audiences, including incident reports and briefings.
• Strong organizational skills for multitasking, meeting deadlines, and managing team workload.
• Ability to work independently and lead a team in fast-paced environments, solving complex problems under pressure.
• Collaborative mindset, strong customer service orientation, and ability to build trust and credibility with customers and team members.
• Dependability, punctuality, responsiveness to management, and attention to detail.
• Must possess the appropriate baseline certification(s) to achieve at least DoWD 8570.01-M IAT Level II (e.g., CompTIA Security+ CE) prior to start.
• Must obtain an additional computing environment certification within six months of hire based on position designation (e.g., CEH, CCNA-Security, CND, etc.).
• When DoW 8140 requirements are implemented on the program/contract, employees must conform to 8140 certification standards.

Nice To Haves

• Experience in a lead or senior role guiding incident response activities or mentoring junior analysts is strongly preferred.

Responsibilities

• Provide day-to-day leadership of CIRT analysts, including tasking, prioritization, and oversight of incident response activities.
• Mentor, coach, and develop team members, including feedback, informal performance guidance, and support for career development.
• Ensure consistent adherence to incident response procedures, quality standards, and timelines.
• Coordinate shift coverage, on-call rotations, and escalation paths to meet mission requirements.
• Serve as the primary point of contact for CIRT-related activities with ARNG stakeholders and other GDIT teams.
• Lead triage of cyber incidents, determining scope, urgency, impact, and recommended courses of action.
• Guide and, when necessary, perform collection and analysis of network/host artifacts (logs, images, packet captures) to identify root cause and operational impact.
• Oversee real-time cyber defense incident handling, ensuring rapid, coordinated response and remediation.
• Direct proactive identification of vulnerabilities and recommend mitigations to reduce risk.
• Demonstrate and validate effectiveness of defenses through coordination with Red Team activities and investigations.
• Ensure cyber defense incidents are managed, documented, and tracked from detection through resolution, with clear, concise reporting.
• Maintain and improve Incident Response tactics, techniques, procedures (TTPs), and training documentation.
• Plan and oversee the delivery of incident response training courses (at least four per calendar year), delegating instruction and ensuring quality content.
• Support efforts to maintain the customer’s CSSP accreditation, including documentation, technical writing, and audit support.
• Drive continuous improvement in incident response workflows, tools usage, and reporting.
• Provide timely briefings and written reports to ARNG leadership and other stakeholders on incident status, trends, and lessons learned.
• Participate in and often lead cross-functional meetings to improve cybersecurity posture across the environment.
• Coordinate closely with engineering, operations, and other cyber defense teams to ensure alignment and effective mitigation of threats.
• Support on-call and after-hours activities as needed, and ensure the team is prepared to respond to time-sensitive events under tight deadlines.

Benefits

• Comprehensive benefits and wellness packages
• 401(k) with company match
• Competitive pay
• Paid time off
• Full flex work weeks where possible
• Variety of paid time off plans, including vacation, sick and personal time, holidays, paid parental, military, bereavement and jury duty leave.
• Short and long-term disability benefits
• Life, accidental death and dismemberment, personal accident, critical illness and business travel and accident insurance are provided or available.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior