Incident Response Lead

Zermount•Arlington, VA

14h•Hybrid

About The Position

The Incident Response Shift Lead is a senior analyst responsible for real-time monitoring, triage, incident intake, investigation, coordinated response, shift execution, and analyst mentoring. The role leads an assigned shift, manages urgent technical work, maintains clear operational handoffs, and develops defensible conclusions from incomplete or ambiguous evidence across on-premises and cloud environments. The position operates in a hybrid federal customer environment, with regular onsite presence and periodic travel between supported operating locations potentially required. The assigned SOC shift operates 24x7 and may include days, nights, weekends, and holidays. On-call and non-regular-duty coverage may also be required. An active Secret clearance and ability to pass a minimum background investigation are required.

Requirements

Seven or more years of cybersecurity experience, including substantial hands-on SOC, incident-response, cyber-defense, or threat-analysis work.
Demonstrated ability to solve difficult or unclear technical problems through deep analysis and collaboration with internal experts.
Hands-on experience with enterprise SIEM, endpoint security, network-security monitoring, and case-management technologies.
Strong incident documentation and briefing skills, including the ability to distinguish facts, interpretations, and unresolved questions.
Ability to work an assigned 24x7 shift and support after-hours coverage as required.
Bachelor's degree in cybersecurity, computer science, information systems, engineering, or a related field; additional relevant experience may be considered in lieu of a degree.
Active Secret clearance required.
Ability to pass a minimum background investigation.

Nice To Haves

Five or more years in a 24x7 SOC or incident response center, including experience as a shift lead or senior analyst.
Experience investigating incidents across on-premises, AWS, Azure, Microsoft 365, identity, endpoint, and network environments.
GCIH, GCIA, GCFA, CySA+, CEH, Security+, or comparable role-aligned cybersecurity certifications.
Working knowledge of widely used incident-response and federal incident-notification guidance.
Demonstrated ability to communicate clearly with technical and customer leads during high-priority events.

Responsibilities

Lead an assigned SOC shift and coordinate monitoring, triage, incident intake, investigation, escalation, and response activities.
Monitor alerts, logs, events, and security data for anomalous or malicious activity; determine severity, impact, and required escalation.
Receive, review, document, and coordinate suspicious-activity and incident reports from authorized internal and external sources.
Analyze incidents to identify relevant activity, affected systems, indicators of compromise, event timelines, likely cause, severity, scope, and operational impact.
Correlate alerts, logs, endpoint data, network data, cloud telemetry, threat intelligence, artifacts, and prior cases to develop defensible findings.
Document evidence, confidence levels, analytical judgments, unresolved questions, and recommended response or remediation actions.
Recommend and support containment, eradication, recovery, and post-incident improvement activities with system and service owners.
Create, update, and maintain accurate incident records; support closure only after required remediation, coordination, and documentation are complete.
Conduct disciplined shift handoffs covering open incidents, pending notifications, degraded tools or feeds, approvals, risks, and deadline-sensitive actions.
Operate and troubleshoot assigned SOC tools and escalate platform or engineering problems through the designated technical lead.
Mentor junior analysts, review work products, reinforce procedures, and contribute to lessons learned and playbook improvements.
Participate in exercises, continuity activities, and surge operations as assigned.