Incident Response Lead

Parsons Corporation•Linthicum, MD

2d•$134,100 - $241,400•Onsite

About The Position

Parsons is looking for an experienced Incident Response Lead to guide a team performing high-impact cyber investigations and analysis in support of critical mission objectives. This role offers the opportunity to combine deep incident response expertise with leadership, mentorship, and continuous improvement in an environment where technical excellence and mission success go hand in hand. In this role, you will lead a team responsible for conducting incident response activities, including host-based and network-based forensic analysis, identifying indicators of compromise, and correlating findings across multiple data sources to detect, investigate, and understand Advanced Persistent Threat (APT) activity. You will help ensure the team applies sound investigative tradecraft, maintains high technical standards, and evolves its methods as new tools, technologies, and threats emerge. Your leadership will directly support mission success by strengthening the team’s ability to identify and respond to sophisticated cyber threats. This position is ideal for someone who combines deep incident response expertise with strong leadership and mentoring capability. You will work closely with a highly technical team, providing day-to-day leadership, mentorship, and support while helping team members strengthen their skills and advance their careers. You’ll also play an important role in improving processes, refining investigative workflows, and driving technical excellence across the team. You’ll be joining Parsons’ local Analytics & Engineering team, a community known for its strong culture of defensive cyber operations, technical excellence, and collaboration. We invest in both mission success and team connection through regular social events, technical talks, training opportunities, and hands-on innovation activities at our Cybersecurity Center of Excellence Lab in Columbia, MD. From team lunches and ice cream socials to family-friendly seasonal events and technical learning sessions, we work hard to create an environment where people can do meaningful work and enjoy being part of the team.

Requirements

Active TS/SCI clearance
GCIH or equivalent incident response certification
Bachelors degree and 8+ years experience
8+ years of hands-on experience in Digital Forensics and Incident Response (DFIR), with at least 5 years focused on network intrusion analysis, malware forensics, and memory analysis
3+ years in a leadership or supervisory role, responsible for leading intrusion investigations, managing incident responders, and briefing technical findings to leadership
Demonstrated experience within the last three years analyzing advanced persistent threat (APT) activity and correlating findings from multiple data sources (e.g., host forensics, network logs, and threat intelligence)
Strong understanding of cyber threat investigation, incident handling, and analytic tradecraft
Ability to lead technical teams in a fast-paced cybersecurity environment
Strong written and verbal communication skills

Nice To Haves

Experience leading incident response teams supporting Government or national security missions
Familiarity with threat hunting, malware analysis, digital forensics, and adversary tracking
Experience correlating data across endpoint, network, log, and forensic sources
Proven ability to improve incident response processes, technical quality, and team performance
Passion for mentoring and developing highly technical cybersecurity professionals

Responsibilities

Lead a team performing advanced incident response and cyber analysis in support of customer mission requirements
Oversee investigations involving host-based and network-based forensic analysis
Correlate data from multiple sources to identify, analyze, and track malicious activity, including APT behaviors and indicators
Guide investigative efforts to determine scope, impact, root cause, and recommended response actions
Ensure the team produces clear, accurate, and actionable reporting on findings and incident activity
Promote incident response best practices, technical rigor, and continuous improvement across workflows and processes
Evaluate and adopt emerging tools, technologies, and methodologies that improve incident response effectiveness
Mentor analysts and support their technical development and career growth
Collaborate with internal technical teams and stakeholders to strengthen mission outcomes and operational performance