NIH - Incident Response Lead

cFocus Software Incorporated•Bethesda, MD

2d•Remote

About The Position

cFocus Software seeks an Incident Response Lead to join our program supporting the National Institutes of Health (NIH). This position is fully remote. This position requires a Public Trust or the ability to obtain a public trust clearance.

Requirements

Public Trust Clearance
B.S. Computer Science, Information Technology, or a related field
7+ years leading enterprise incident response activities.
Experience supporting federal cybersecurity programs and Security Operations Centers.
Experience coordinating enterprise cyber investigations involving cloud and hybrid environments.
Experience implementing NIST incident response methodologies.
Active GCIH, GCFA, GNFA, CISSP, CEH, CySA+, Security+, CISM, or CCSP

Responsibilities

Lead enterprise cybersecurity incident response operations across NIH information systems.
Direct technical response activities throughout the incident response lifecycle including preparation, identification, containment, eradication, recovery, and post-incident activities.
Coordinate response efforts for high-impact cybersecurity incidents affecting enterprise infrastructure, cloud services, applications, and data.
Serve as the primary technical advisor during cybersecurity incidents and major security events.
Manage incident prioritization, escalation, resource coordination, and operational communications.
Ensure incident response activities comply with NIH policies, HHS guidance, NIST standards, and federal cybersecurity requirements.
Lead technical investigations involving malware infections, unauthorized access, insider threats, ransomware, phishing campaigns, data exfiltration, and advanced persistent threats (APTs).
Coordinate root cause analysis and determine attack vectors, affected assets, and operational impact.
Analyze indicators of compromise (IOCs), indicators of attack (IOAs), adversary tactics, techniques, and procedures (TTPs), and attack patterns.
Coordinate evidence collection and preservation activities supporting investigations.
Validate containment strategies and recovery actions.
Ensure accurate documentation of incident timelines, findings, corrective actions, and lessons learned.
Coordinate with Security Operations Center analysts during incident detection and response activities.
Oversee incident triage, escalation procedures, and operational communications.
Direct coordination between cybersecurity engineers, cloud engineers, infrastructure teams, system owners, ISSOs, and application administrators.
Support continuous monitoring and operational readiness activities.
Develop executive incident reports, after-action reports, technical findings, and corrective action recommendations.
Prepare briefings for Government leadership regarding significant cybersecurity events.
Maintain incident response metrics, trends, dashboards, and performance reporting.
Ensure timely reporting in accordance with federal cybersecurity reporting requirements.