Incident Response (IR) and Forensics Lead (Q Clearance)

ShorePoint•Germantown, MD

2d•Onsite

About The Position

ShorePoint is seeking an Incident Response (IR) and Forensics Lead to manage day-to-day team operations while performing hands-on cyber incident investigations, forensic analysis and response activities. This role provides technical support across cybersecurity areas including cloud security, endpoint security, access management, secure networking and IR. The IR and Forensics Lead position coordinates IR activities, provides technical support across the enterprise and communicates incident findings and responses to customers and federal leadership. This is a unique opportunity to shape the growth, development and culture of an exciting and fast-growing company in the cybersecurity market.

Requirements

Knowledge of IR and digital forensics principles and practices.
Understanding of cybersecurity operations, including cloud security, endpoint security, access management and secure networking.
Knowledge of security risk assessment and cyber incident analysis.
Bachelor’s degree or Associate’s degree plus an additional 2+ years of experience.
7+ years of relevant experience.
Proven ability to analyze complex requirements and translate them into clear, actionable tasks and processes through critical thinking.
Applicants must currently hold and maintain an active DOE Q or equivalent DoD Top Secret clearance.

Nice To Haves

Industry recognized certifications.

Responsibilities

Manage day-to-day operations of the IR and forensics team.
Conduct briefings, coordinate directly with customers and develop IRs for senior federal leadership.
Collect and analyze intrusion artifacts, including source code, malware and trojans, to support mitigation of potential cyber defense incidents across the enterprise.
Coordinate and provide expert technical support to enterprise-wide cyber defense technicians to resolve cyber defense incidents.
Coordinate IR functions.
Monitor external data sources, including cyber defense vendor sites and Computer Emergency Response resources, to support IR activities.