Incident Manager I

ARSIEM • Arlington, VA

7d • Onsite

About The Position

ARSIEM Corporation is seeking a Cyber Incident Manager to support a government client in Arlington, Virginia. The role correlates incident data to identify trends in reported incidents and supports Computer Network Defense (CND) incident response, analysis, mitigation, tracking, and resolution. The position also provides support during assigned shifts.

Requirements

• Bachelor of Science in Incident Management, Operations Management, Cybersecurity, or a related field; alternatively, a high school diploma and three years of incident management or cybersecurity experience.
• At least one year of directly relevant experience in cyber incident management or cybersecurity operations.
• Knowledge of incident response and handling methodologies.
• Close familiarity with the latest revision of NIST 800-62 and FISMA standards as they pertain to incident reporting.
• Knowledge of the NCCIC National Cyber Incident Scoring System for prioritizing incident triage.
• Knowledge of general attack stages, including footprinting and scanning, enumeration, gaining access, privilege escalation, maintaining access, network exploitation, and covering tracks.
• Ability to recognize and categorize vulnerability types and associated attacks.
• Knowledge of basic system administration and operating system hardening techniques, as well as CND policies, procedures, and regulations.
• Knowledge of different operational threat environments, including script kiddies, non-nation-state-sponsored actors, and nation-state-sponsored actors.
• Knowledge of system and application security threats and vulnerabilities, including buffer overflow, mobile code, cross-site scripting, PL/SQL and injections, race conditions, covert channels, replay, return-oriented attacks, and malicious code.
• Active TS/SCI clearance and ability to obtain Department of Homeland Security Entry on Duty Suitability.

Nice To Haves

• Knowledge of different operational threat environments, including script kiddies, non-nation-state-sponsored actors, and nation-state-sponsored actors.
• Knowledge of system and application security threats and vulnerabilities, including buffer overflow, mobile code, cross-site scripting, PL/SQL and injections, race conditions, covert channels, replay, return-oriented attacks, and malicious code.
• Desired certifications: GCIH, GCFA, GISP, GCED, CCFP, or CISSP.

Responsibilities

• Correlate incident data to identify trends in reported incidents.
• Recommend defense-in-depth principles and practices, including layered defenses and security robustness.
• Perform CND incident triage, determining scope, urgency, and potential impact.
• Research and compile known resolution steps or workarounds to help mitigate potential CND incidents within the enterprise.
• Apply cybersecurity concepts to detect and defend against intrusions into small- and large-scale IT networks, and conduct cursory analysis of log data.
• Monitor external data sources to stay current on CND threat conditions and determine which security issues may affect the enterprise.
• Identify incident causes and determine key questions for external entities about an incident's background and potential infection vector.
• Receive and analyze network alerts from sources within the enterprise and determine possible causes.
• Track and document CND incidents from initial detection through final resolution, coordinating information about ongoing incidents with other organizational components.
• Provide support during assigned shifts.

Benefits

• A $3,500 candidate referral bonus is available for a new candidate who is successfully placed; the bonus is paid after the referred employee reaches six months of employment.

What This Job Offers

• Job Type: Full-time
• Career Level: Entry Level