Incident Detection and Response Manager (Lead) - Remote

S2i2 Inc•Richmond, VA

7d•$130,000 - $160,000•Remote

About The Position

The Incident Detection and Response Manager IV leads incident response for our client's Risk Management program and owns the Incident Response as Code workstream under the program's Everything as Code modernization. The position has two main components: incident response management in a FISMA High environment holding sensitive personal and financial data, and engineering to automate incident response processes. The role requires meeting strict service level agreements for incident notification, breach reporting, service restoration, and root cause analysis. The manager will present at daily Security Operations Center meetings, coordinate with government stakeholders, and support breach response for specific institutions. The engineering aspect involves designing, building, and integrating automated playbooks for classification, notification, containment, and evidence capture using tools like GitLab and AWS, integrating with Splunk, Tenable, and Qualys telemetry. All developed solutions must be reproducible from version control and delivered to the Government with unlimited rights.

Requirements

Ten or more years in cybersecurity with at least five years leading incident response or security operations for a federal agency or a comparably regulated enterprise.
Demonstrated incident command experience: leading response to real incidents end to end, including containment, eradication, recovery, root cause analysis and executive and regulator communication.
Hands on automation of incident response: SOAR platforms, scripted playbooks (Python preferred), API integration with SIEM and vulnerability tooling, infrastructure or policy as code in Git with CI/CD. The resume must show something the candidate built, not only something they managed.
Working knowledge of NIST SP 800-53 Rev 5, NIST SP 800-61, the NIST Risk Management Framework, FISMA reporting and federal breach notification requirements (OMB M-17-12 or successor).
Experience with Splunk or an equivalent enterprise SIEM, and with AWS.
Experience with FISMA High or FedRAMP High environments and with PII at scale.
US citizen, able to obtain a Department of Education High Risk Public Trust determination.
Able to document measurable outcomes: mean time to detect and respond, incidents handled, SLA attainment, automation coverage, audit findings closed.

Nice To Haves

CISSP plus one of GCIH, GCFA, GCIA, GNFA or CISM.
Experience with OSCAL, policy as code (OPA or similar), GitLab CI, and Atlassian Jira and Confluence.
Experience applying LLM or agentic AI tooling to triage, enrichment or evidence capture, with an understanding of federal AI governance requirements.
Experience with Zero Trust implementation under OMB M-22-09 and with continuous ATO programs.
Experience supporting higher education institutions or financial services partners on breach response under GLBA.

Responsibilities

Serve as the named Key Personnel lead for incident detection and response; the Government must approve any substitution.
Own the incident response plan, playbooks, escalation paths and communications for the program, aligned to NIST SP 800-61, ED OCIO-14 incident reporting procedures and local policy.
Meet contract SLAs for P1 notification (15 minutes), breach reporting (1 hour), critical incident restoration (4 hours) and RCA delivery (5 business days), and deliver the weekly monitoring and incident report.
Design, build and maintain the Incident Response as Code playbook library: automated classification, notification, containment and evidence capture, version controlled in GitLab, deployed through CI/CD pipeline, with automated triggers aligned to safeguard thresholds.
Integrate incident automation with Government furnished telemetry (Splunk, Tenable, Qualys), the GRCT compliance repository and PowerBI dashboards; eliminate manual evidence collection where automation is feasible.
Represent the program at the daily SOC meeting: active incidents and investigations, system health, escalations, planned outages and items for senior leadership.
Support IHE and GLBA breach response and outreach, and coordinate with the Privacy and Safeguards functions on incidents involving PII or Federal Tax Information.
Lead a small team of incident detection and response analysts; mentor on both response discipline and automation practice.
Contribute to the program's Zero Trust gap reduction, continuous monitoring and continuous ATO objectives from the incident response perspective.