Incident Manager III

Arsiem•Arlington, VA

11d•Onsite

About The Position

ARSIEM Corporation is seeking a senior cyber triage subject-matter expert to support a government client in Arlington, Virginia. The role focuses on complex threat-intelligence assessments, advanced technical analysis, mentorship of junior analysts, and coordination with interagency partners. The analyst will help ensure high-quality assessments inform national cyber defense priorities and will contribute to improved triage processes and operational capabilities. The position requires an active TS/SCI clearance and the ability to obtain Department of Homeland Security Entry on Duty suitability. It includes participation in an after-hours on-call rotation for critical incidents.

Requirements

Bachelor’s degree in a technical discipline such as Computer Science, Cybersecurity, or Computer Engineering, or a high school diploma and 7+ years of directly relevant technical experience.
5–7 years of progressive experience in threat intelligence, SOC operations, or cyber incident response.
Demonstrated expertise in malware analysis, threat actor attribution, and cyber campaign analysis.
Advanced proficiency with threat intelligence platforms, SIEM tools, and analytical frameworks.
Deep knowledge of the MITRE ATT&CK framework and intelligence-driven cyber defense concepts.
Proven ability to coordinate with federal agencies and manage complex stakeholder relationships.
Strong understanding of critical infrastructure interdependencies and sector-specific threats.
Exceptional analytical writing skills and ability to communicate complex technical findings to diverse audiences.
Experience briefing technical and non-technical audiences, including senior leadership.
Ability to collaborate across physical locations.
Active TS/SCI clearance and ability to obtain DHS Entry on Duty suitability.

Nice To Haves

Master’s degree.
Prior experience in federal government cybersecurity roles, such as CISA, FBI, NSA, or DoD.
Experience with the CISA NCISS National Cyber Incident Scoring System to prioritize and triage incidents.
Knowledge of general attack stages, including scanning, enumeration, gaining access, privilege escalation, maintaining access, network exploitation, and covering tracks.
Experience recognizing and categorizing vulnerabilities and associated attacks.
Knowledge of Computer Network Defense policies, procedures, and regulations.
Knowledge of operational threat environments, including non-state and nation-state-sponsored threats.
Knowledge of system and application security threats and vulnerabilities, including buffer overflows, mobile code, cross-site scripting, injections, race conditions, covert channels, replay attacks, return-oriented attacks, and malicious code.
Published threat intelligence research or contributions to the open-source security community.
Experience with threat hunting and proactive threat detection methodologies.
Knowledge of foreign adversary cyber capabilities and the geopolitical threat landscape.
Familiarity with the Privacy Act and information-handling requirements for government operations.
CISSP, GCTI, GCFA, GREM, or similar advanced certifications.

Responsibilities

Conduct advanced triage and analysis of complex, high-severity cyber threat intelligence and IOC packages.
Serve as the technical escalation point for challenging or ambiguous threat assessments.
Enrich indicators of compromise using classified and unclassified intelligence sources.
Coordinate joint threat assessments with the FBI, NSA, USCYBERCOM, and other interagency partners.
Mentor and train mid-level and junior triage analysts.
Develop and refine analytical tradecraft, triage playbooks, and decision matrices.
Lead projects to improve triage processes, automation, and threat detection capabilities.
Author detailed threat assessments and intelligence briefs for JCDC leadership and partner organizations.
Represent the triage team in interagency working groups and information-sharing forums.
Identify patterns across threat reports to detect emerging campaigns or threat actor activity.
Review analyst products for quality and provide constructive feedback.
Support an after-hours on-call rotation for critical incidents requiring senior-level triage assessment.
Contribute to strategic planning for JCDC operational capability development.
Work with critical infrastructure sector partners to understand threat concerns and provide tailored analysis.