Incident Manager

Accenture Federal Services•Lorton, VA

About The Position

The CTOC Incident Manager oversees the Incident Management program, processes, and procedures within the CTOC. The role leads and coordinates responses to cybersecurity incidents to protect customer infrastructure and data, managing each incident through detection, analysis, containment, eradication, remediation, and recovery. The Incident Manager coordinates with internal and external leadership, legal teams, and other stakeholders, and works across continuous monitoring, threat analysis, and post-incident reviews to strengthen CTOC capabilities. The position may require work outside core hours during high-priority investigations and includes on-call responsibilities. The role also maintains incident response plans and playbooks, monitors and investigates threats, ensures compliance and reporting, trains and mentors SOC staff, and identifies process and technology improvements, including automation opportunities. An active TS/SCI security clearance is required.

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, or a related field and 3+ years of experience in Incident Response, Security Operations, Cybersecurity, DFIR, Risk Management, IT Service Management, or NOC; or 5+ years of hands-on experience in Incident Response, Security Operations, Cybersecurity, DFIR, Compliance/IA, or related cybersecurity experience.
1+ year of leadership experience in operational environments.
DoD 8570 IAT Level 2 or DoD 8140-compliant certification.
Must obtain Microsoft SC-200 within six months of hire.
Experience with technical and non-technical aspects of incident response, including processes, SOPs, playbooks, and cyber investigative TTPs.
2+ years of technical report-writing experience and strong professional and technical writing skills.
Active TS/SCI security clearance.
Applicants for employment in the US must have work authorization that does not now or in the future require visa sponsorship.

Nice To Haves

Experience with Microsoft Security products.
Scripting experience, such as Bash, PowerShell, or Python.
Working knowledge of advanced persistent threats (APT), associated tactics, attack frameworks such as MITRE ATT&CK and Cyber Kill Chain, and TTPs across the global threat landscape.
DoD 8570 CSSP Incident Responder or similar certification.
Experience with DevSecOps pipelines and the SAFe methodology supporting Security Operations.

Responsibilities

Develop, maintain, and regularly update incident response plans, playbooks, and procedures; ensure SOC staff are trained on them.
Lead and coordinate cybersecurity incident responses and manage the incident lifecycle from detection and analysis through containment, eradication, remediation, and recovery.
Serve as the primary point of contact during incidents and communicate with executive leadership, legal teams, customers, and other internal and external stakeholders.
Coordinate incident response with Security teams, Networking/NOC, Engineering, Legal, business units, and other stakeholders; foster relationships with external partners and law enforcement.
Assist in overseeing continuous monitoring of security systems, including SIEM and other security tools.
Lead in-depth incident analyses and investigations to identify root causes, attack vectors, and potential impacts; develop strategies to mitigate risks and prevent future incidents.
Conduct post-incident reviews, document findings and lessons learned, and implement improvements.
Ensure compliance with applicable security standards, regulations, and policies; prepare and present detailed incident reports.
Train and guide SOC staff in incident response practices, tools, and procedures; mentor junior team members and encourage continuous learning.
Stay current with cybersecurity trends, tools, and technologies and recommend and implement improvements to SOC response capabilities, processes, and technologies.
Identify opportunities to automate response processes and improve operational efficiency; develop and implement scripts and tools to streamline incident management.