Cyber Shift Incident Manager

BCMC • Arlington, VA

5d • Onsite

About The Position

BCMC is supporting a U.S. Government customer by providing onsite incident response to civilian Government agencies and critical asset owners experiencing cyber-attacks. The work includes investigating breaches to characterize their severity, developing mitigation plans, and assisting with service restoration. This role supports that customer mission and is onsite only. The assigned Shift 4 schedule is Saturday and Sunday, 0600–1830, and Monday, Tuesday, Thursday, and Friday, 0800–1630.

The Cyber Shift Incident Manager handles Computer Network Defense (CND) incident triage and tracking, analyzes alerts and incident data, researches mitigation steps, and coordinates incident information across organizational components. The position requires U.S. citizenship, an active TS/SCI clearance, and the ability to obtain DHS Suitability. Candidates need five or more years of directly relevant cyber incident management or cybersecurity operations experience, along with the stated incident response, security, and threat knowledge.

Education requirements are a bachelor’s degree in Incident Management, Operations Management, Cybersecurity, or a related field, or a high school diploma with 7–9 years of incident management or cybersecurity experience. Desired certifications include GCIH, GCFA, GISP, GCED, CCFP, or CISSP.

Requirements

• U.S. citizenship.
• Active TS/SCI clearance.
• Ability to obtain DHS Suitability.
• At least 5 years of directly relevant experience in cyber incident management or cybersecurity operations.
• Knowledge of incident response and handling methodologies.
• Close familiarity with the latest revision of NIST 800-62 and FISMA standards as they pertain to incident reporting.
• Knowledge of the NCCIC National Cyber Incident Scoring System for prioritizing incident triage.
• Knowledge of general attack stages, including footprinting and scanning, enumeration, gaining access, privilege escalation, maintaining access, network exploitation, and covering tracks.
• Skill in recognizing and categorizing vulnerability types and associated attacks.
• Knowledge of basic system administration and operating system hardening techniques, and of Computer Network Defense policies, procedures, and regulations.
• Knowledge of operational threat environments, including first-generation script kiddies, second-generation non-nation-state-sponsored, and third-generation nation-state-sponsored threats.
• Knowledge of system and application security threats and vulnerabilities, including buffer overflow, mobile code, cross-site scripting, PL/SQL and injections, race conditions, covert channel, replay, return-oriented attacks, and malicious code.
• Bachelor’s degree in Incident Management, Operations Management, Cybersecurity, or a related degree; alternatively, a high school diploma with 7–9 years of incident management or cybersecurity experience.

Nice To Haves

• Knowledge of operational threat environments, including first-generation script kiddies, second-generation non-nation-state-sponsored, and third-generation nation-state-sponsored threats.
• Knowledge of system and application security threats and vulnerabilities, including buffer overflow, mobile code, cross-site scripting, PL/SQL and injections, race conditions, covert channel, replay, return-oriented attacks, and malicious code.
• Desired certifications: GCIH, GCFA, GISP, GCED, CCFP, or CISSP.

Responsibilities

• Correlate incident data to identify trends in reported incidents.
• Recommend defense-in-depth principles and practices, including layered defenses and security robustness.
• Perform Computer Network Defense incident triage, determining scope, urgency, and potential impact.
• Research and compile known resolution steps or workarounds to mitigate potential Computer Network Defense incidents within the enterprise.
• Apply cybersecurity concepts to detect and defend against intrusions into small- and large-scale IT networks, and conduct cursory analysis of log data.
• Monitor external data sources to stay current on Computer Network Defense threat conditions and determine which security issues may affect the enterprise.
• Identify incident causes and recognize what information to request from external entities about an incident’s background and potential infection vector.
• Receive and analyze network alerts from enterprise sources and determine possible causes.
• Track and document Computer Network Defense incidents from initial detection through final resolution, coordinating information about ongoing incidents with other organizational components.
• Provide support during the assigned shift: Saturday and Sunday, 0600–1830; Monday, Tuesday, Thursday, and Friday, 0800–1630.

Benefits

• Extremely competitive salary.
• 95% employer-paid employee medical, dental, and vision coverage.
• 100% employer-paid employee life, short-term disability, and long-term disability coverage.
• 401(k) with company match.
• Flexible Spending Account for dependent and health care.
• 11 standard holidays and 3 weeks of annual leave.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level