Incident Manager I

Arsiem • Arlington, VA

2d

About The Position

ARSIEM Corporation is seeking a Cyber Incident Manager to support a government client in Arlington, Virginia. The role correlates incident data to identify trends in reported incidents and supports Computer Network Defense (CND) incident triage, investigation, mitigation, and resolution. The position also provides support during assigned shifts.

Requirements

• Bachelor's degree in Incident Management, Operations Management, Cybersecurity, or a related field; alternatively, a high school diploma with 3 years of incident management or cybersecurity experience.
• At least 1 year of directly relevant experience in cyber incident management or cybersecurity operations.
• Knowledge of incident response and handling methodologies.
• Close familiarity with the latest revision of NIST 800-62 and FISMA standards as they pertain to incident reporting.
• Knowledge of the NCCIC National Cyber Incident Scoring System to prioritize incident triage.
• Knowledge of general attack stages, including footprinting and scanning, enumeration, gaining access, privilege escalation, maintaining access, network exploitation, and covering tracks.
• Skill in recognizing and categorizing types of vulnerabilities and associated attacks.
• Knowledge of basic system administration and operating system hardening techniques, as well as CND policies, procedures, and regulations.
• Knowledge of operational threat environments, including script kiddies, non-nation-state-sponsored, and nation-state-sponsored actors.
• Knowledge of system and application security threats and vulnerabilities, including buffer overflow, mobile code, cross-site scripting, PL/SQL and injections, race conditions, covert channels, replay, return-oriented attacks, and malicious code.
• Active TS/SCI clearance and ability to obtain Department of Homeland Security (DHS) Entry on Duty (EOD) Suitability.

Nice To Haves

• Knowledge of operational threat environments, including script kiddies, non-nation-state-sponsored, and nation-state-sponsored actors.
• Knowledge of system and application security threats and vulnerabilities, including buffer overflow, mobile code, cross-site scripting, PL/SQL and injections, race conditions, covert channels, replay, return-oriented attacks, and malicious code.
• Desired certifications: GCIH, GCFA, GISP, GCED, CCFP, or CISSP.

Responsibilities

• Correlate incident data to identify trends in reported incidents.
• Recommend defense-in-depth principles and practices, including layered defenses and security robustness.
• Perform CND incident triage, determining scope, urgency, and potential impact.
• Research and compile known resolution steps or workarounds to mitigate potential CND incidents within the enterprise.
• Apply cybersecurity concepts to intrusion detection and defense across small- and large-scale IT networks, and conduct cursory analysis of log data.
• Monitor external data sources to stay current on CND threat conditions and determine which security issues may affect the enterprise.
• Identify incident causes and determine relevant questions for external entities about an incident's background and potential infection vector.
• Receive and analyze network alerts from enterprise sources and determine possible causes.
• Track and document CND incidents from initial detection through final resolution, coordinating information with other organizational components.
• Provide support during assigned shifts.

Benefits

• A $3,500 candidate referral bonus is available for eligible referrals resulting in a placement; it is paid after the referred employee reaches 6 months of employment.

What This Job Offers

• Job Type: Full-time
• Career Level: Entry Level