Incident Manager II

Arsiem•Arlington, VA

15d•Onsite

About The Position

ARSIEM Corporation is seeking an Incident Manager II to support a government client in Arlington, Virginia. The posting describes the work as a JCDC Cyber Triage Analyst role, serving as a frontline contributor to the nation’s cyber defense posture. The analyst performs initial analysis and triage of cyber threat reports, indicators of compromise (IOCs), and incident notifications submitted to the JCDC. This is not a developmental position; analysts work similarly to Tier 1/2 SOC analysts with enhanced threat intelligence responsibilities and are expected to independently research cyber activity, evaluate available information, reach defensible analytical conclusions, identify information gaps, and recommend follow-on actions while coordinating with government and private-sector partners. The role requires an active TS/SCI clearance and the ability to obtain DHS Entry on Duty (EOD) Suitability. The minimum education requirement is a bachelor’s degree in a technical discipline such as computer science, cybersecurity, or computer engineering, or a high school diploma with at least four years of directly relevant technical experience. The posting also requires 2–4 years of progressive experience in threat intelligence, SOC operations, or cyber incident response.

Requirements

Bachelor’s degree in a technical discipline from an accredited college or university, such as Computer Science, Cybersecurity, or Computer Engineering, or a high school diploma and 4+ years of directly relevant technical experience.
2–4 years of progressive experience in threat intelligence, SOC operations, or cyber incident response.
Active TS/SCI clearance.
Ability to obtain Department of Homeland Security (DHS) Entry on Duty (EOD) Suitability.

Nice To Haves

Prior experience in federal government cybersecurity roles, such as CISA, FBI, NSA, or DoD.
Understanding of the CISA NCISS National Cyber Incident Scoring System for prioritizing and triaging incidents.
Knowledge of general attack stages, including footprinting and scanning, enumeration, gaining access, privilege escalation, maintaining access, network exploitation, and covering tracks.
Demonstrated experience recognizing and categorizing vulnerabilities and associated attacks.
Knowledge of Computer Network Defense policies, procedures, and regulations.
Knowledge of operational threat environments, including first-generation script kiddies, second-generation non-nation-state-sponsored actors, and third-generation nation-state-sponsored actors.
Knowledge of system and application security threats and vulnerabilities, such as buffer overflow, mobile code, cross-site scripting, PL/SQL and injections, race conditions, covert channels, replay, return-oriented attacks, and malicious code.
Experience with SIEM platforms, threat intelligence platforms (TIP), and ticketing systems.
Knowledge of critical infrastructure sectors and associated cyber risks.
Familiarity with DHS/CISA products and services.
Security+, CySA+, GCIH, GCIA, or similar certifications.

Responsibilities

Perform initial triage and assessment of incoming cyber threat tickets, incident reports, and IOC submissions.
Analyze technical data, including IP addresses, domain names, file hashes, network traffic patterns, and malware artifacts.
Determine threat severity, credibility, and potential impact to critical infrastructure sectors.
Enrich IOCs using threat intelligence platforms, open-source intelligence (OSINT), and government-exclusive resources.
Prepare concise triage reports with actionable recommendations for escalation or further analysis.
Route tickets to appropriate JCDC teams, CISA divisions, or interagency partners based on assessment findings.
Coordinate with sector-specific analysts and interagency liaisons to gather additional context.
Maintain accurate documentation in ticketing systems and knowledge management platforms.
Participate in shift handoffs and contribute to daily operational briefings.
Support development of triage playbooks and standard operating procedures.
Monitor emerging threat campaigns and trending adversary activity.
Provide feedback to submitters and partner organizations on ticket status and outcomes.
Work collaboratively across physical locations.