Incident Report Lead

ISI Enterprises • Herndon, VA

144d • $120,000 - $135,000

About The Position

ISI Defense is seeking a cleared, mission-driven Incident Response Lead to lead and scale our IR operations across both internal environments and our Managed Services client base. This role combines deep technical hands-on response with high-stakes coordination across cross-functional teams, multiple departments, legal, ISI stakeholders, and external partners. As the Incident Response Lead, you will serve as our go-to expert when the signal hits. You’ll shape how we detect, contain, investigate, and recover from incidents—while maturing the processes that power our growing SOC. You’ll be our first call when an incident escalates, leading both the hands-on technical response and the cross-functional collaboration required to mitigate threats and drive systemic improvement.

Requirements

• Current, interim eligibility or previous security clearance.
• 5+ years of hands-on incident response and investigation experience across cloud and on-premise environments.
• Strong working knowledge of Microsoft Defender suite, Sentinel, PowerShell, and endpoint/cloud forensics.
• Proven ability to lead investigations from triage through containment and recovery.
• Proven ability to deliver clear and concise incident reporting to technical and executive stakeholders, including RCA and threat narratives.
• Experience coordinating with cross-functional teams—including DevOps, Engineering, Support, and Helpdesk—during real-time IR scenarios.
• Familiarity with CMMC 2.0, NIST 800-171, NIST 800-61, and IR planning under regulatory oversight.

Nice To Haves

• GCIH, GCFA, GCIA, or similar GIAC certifications.
• CISSP, CISM, or CRISC for strategic oversight.
• Microsoft Certified: Cybersecurity Architect Expert, SC-200, or SC-300.
• Active or previous U.S. security clearance (Secret or above) a strong plus.

Responsibilities

• Act as incident commander during security events, owning containment, triage, forensic investigation, and root cause analysis.
• Work directly with SOC Analysts, Support teams, Engineering leads, and Compliance during investigations.
• Perform hands-on analysis containment, endpoint analysis, log review, and threat validation using Microsoft Defender, Sentinel, and PowerShell.
• Serve as incident commander—owning IR communication flow across executive, technical, and legal stakeholders during active investigations.
• Coordinate with external IR firms, insurance brokers and legal counsel during privileged investigations.
• Liaise with our SOC, Engineering, Support and Compliance teams to drive effective response and recovery.
• Develop and tune Sentinel analytics rules, Defender policies, and response workflows.
• Create and maintain incident response playbooks, tabletop exercises, and AAR processes.
• Lead proactive threat hunting activities across tenant environments.
• Track emerging TTPs and continuously refine detections and hunting logic.

Benefits

• Competitive salary range: $120,000-$135,000.
• Comprehensive benefits package, including generous PTO.
• Flexible hybrid work schedule.
• Opportunities for professional growth and training.
• A collaborative and innovative company culture that values teamwork and continuous improvement.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior