Cyberspace Incident Manager, Lead Associate

Peraton•Augusta, GA

3d•$104,000 - $166,000•Onsite

About The Position

Peraton seeks a Cyberspace Incident Manager, Lead Associate, to support ARCYBER G3 in Fort Gordon, Georgia. The role manages suspected and confirmed cyberspace incidents across the Army’s unclassified and classified DoD/DoW enterprise automation environments through the Army’s Incident Management program of record. It covers incident intake, categorization, prioritization, escalation, task order generation, documentation, routing, response tracking, and closure, in accordance with applicable Army and DoD directives and reporting timelines. The position processes threat intelligence and Indicators of Attack/Indicators of Compromise, translates them into actionable task orders, and tracks remediation across the enterprise. It performs quality assurance and quality control of incident records, coordinates incident findings with relevant Army organizations and mission partners, and produces reporting through briefings, technical write-ups, and data visualizations. The role also develops and maintains continuity documents and CSSP accreditation artifacts, facilitates working groups, and supports Military Decision Making Process efforts relevant to incident management.

Requirements

Minimum of 5 years of experience with a bachelor’s degree; 3 years with a master’s degree; or 0 years with a PhD. HS plus 9 years or an associate degree plus 7 years of experience will also be considered.
Demonstrated expertise in enterprise-scale cyberspace incident management, including incident lifecycle governance, reporting standards enforcement, cross-organizational coordination, and process standardization across a large DoD network environment.
Deep familiarity with CJCSM 6510.01B, AR 25-2, DA PAM 25-2, and DoD incident handling and escalation procedures.
Must possess a DoD 8570 IAT Level II certification: CCNA, CySA+, GICSP, GSEC, Security+, CND, or SSCP.
Must possess a DoD 8570 CSSP-Analyst certification: CEH, CFR, CCNA, CySA+, GCIA, GCIH, GICSP, Cloud+, SCYBER, or PenTest+.
Able to support 8x5 operations with on-call surge support as mission requires.
U.S. citizenship is required.
Active TS clearance, with the ability to obtain and maintain SCI, Polygraph, and MEAD clearance.

Nice To Haves

Hands-on experience with the Army Incident Management program of record in unclassified and/or classified automation environments.
Experience with USCYBERCOM reporting tools or DoD CSSP reporting pipelines.
Familiarity with the Microsoft Defender suite at a dashboard or reporting level for operational situational awareness.
Experience developing or contributing to Microsoft Power Platform dashboards or equivalent operational metrics reporting.
Experience with ServiceNow or comparable ITSM platforms used in incident management workflows.
Experience with API-based data integration between enterprise security platforms.
Experience with IT and OT cyberspace incident management or coordination within Army/DoD enterprise environments.
Familiarity with networking protocols and experience triaging network traffic to identify anomalous or potentially malicious activity.

Responsibilities

Manage the lifecycle of suspected and confirmed cyberspace incidents across Army unclassified and classified enterprise automation environments, including intake, categorization, prioritization, escalation, task order generation, documentation, routing, and closure tracking.
Ensure incidents are handled in accordance with CJCSM 6510.01B, AR 25-2, DA PAM 25-2, and other applicable directives; track response actions to resolution and verify timely reporting to appropriate parties.
Receive and process threat intelligence products and Indicators of Attack/Indicators of Compromise notifications; translate them into actionable task orders and track remediation to completion across the enterprise.
Conduct quality assurance and quality control across records in the Army Incident Management program of record in support of ARCYBER G3 reporting standards.
Coordinate and route incidents and findings to superior, lateral, and subordinate organizations, the Army Criminal Investigation Division, and the Army intelligence warfighting function as appropriate.
Produce and deliver incident management reporting, including verbal briefings, technical write-ups, and data visualizations, in accordance with Army reporting requirements.
Use technologies such as Microsoft Power BI, Power Automate, and Power Apps to develop leadership-facing dashboards and automate recurring incident management tasks and reporting workflows.
Develop and maintain team and directorate continuity documents and CSSP accreditation artifacts.
Facilitate incident management working groups and coordinate with internal and external mission partners in support of government-defined enterprise incident management outcomes.
Support directorate and ARCYBER-level Military Decision Making Process efforts for incident management-relevant functions.