Incident Manager II

Solutions³ LLC•Arlington, VA

47d•$56,000 - $66,000•Onsite

About The Position

Solutions³ LLC is supporting a U.S. Government customer by providing rapid deployment and management of secure, cloud-based engagement kits for cyber incident response and threat hunting. As part of the Engagement Support Services (ESS) contract, the program helps analysts access tools and environments needed to investigate cyber threats affecting federal agencies, state and local governments, and critical infrastructure. The posting describes the work as a frontline cyber defense role focused on initial analysis and triage of cyber threat reports, indicators of compromise (IOCs), and incidents. It is not a developmental position. Analysts are expected to work similarly to Tier 1/2 SOC analysts, with enhanced threat intelligence responsibilities, independently researching cyber activity, assessing available information, reaching defensible conclusions, identifying information gaps, and recommending follow-on actions. The role also involves coordination with government and private-sector partners. The posting lists the role as 100% onsite and gives a salary range of $56,000–$66,000. Candidates must be U.S. citizens, hold an active TS/SCI clearance, and be able to obtain DHS Suitability before starting employment.

Requirements

Must be a U.S. citizen.
Must have an active TS/SCI clearance.
Must be able to obtain DHS Suitability prior to starting employment.
3–5 years of progressive experience in threat intelligence, SOC operations, or cyber incident response.
Bachelor of Science in a technical discipline from an accredited college or university, such as Computer Science, Cybersecurity, Computer Engineering, or a related discipline; alternatively, a high school diploma and 4+ years of directly relevant technical experience.
Must be able to work collaboratively across physical locations.

Nice To Haves

Prior experience in federal government cybersecurity roles, such as CISA, FBI, NSA, or DoD.
Understanding of the CISA NCISS National Cyber Incident Scoring System to prioritize incident triage.
Knowledge of general attack stages, including footprinting and scanning, enumeration, gaining access, privilege escalation, maintaining access, network exploitation, and covering tracks.
Demonstrated experience recognizing and categorizing vulnerabilities and associated attacks.
Knowledge of Computer Network Defense policies, procedures, and regulations.
Knowledge of different operational threat environments, including first-generation, second-generation, and third-generation threats.
Knowledge of system and application security threats and vulnerabilities, such as buffer overflow, mobile code, cross-site scripting, PL/SQL and injections, race conditions, covert channels, replay, return-oriented attacks, and malicious code.
Experience with SIEM platforms, threat intelligence platforms (TIP), and ticketing systems.
Knowledge of critical infrastructure sectors and associated cyber risks.
Familiarity with DHS/CISA products and services.
Security+, CySA+, GCIH, GCIA, or similar certification.

Responsibilities

Perform initial triage and assessment of incoming cyber threat tickets, incident reports, and IOC submissions.
Analyze technical data, including IP addresses, domain names, file hashes, network traffic patterns, and malware artifacts.
Determine threat severity, credibility, and potential impact to critical infrastructure sectors.
Enrich IOCs using threat intelligence platforms, open-source intelligence (OSINT), and government-exclusive resources.
Prepare concise triage reports with actionable recommendations for escalation or further analysis.
Route tickets to appropriate JCDC teams, CISA divisions, or interagency partners based on assessment findings.
Coordinate with sector-specific analysts and interagency liaisons to gather additional context.
Maintain accurate documentation in ticketing systems and knowledge management platforms.
Participate in shift handoffs and contribute to daily operational briefings.
Support development of triage playbooks and standard operating procedures.
Monitor emerging threat campaigns and trending adversary activity.
Provide feedback to submitters and partner organizations on ticket status and outcomes.
Work collaboratively across physical locations.