Senior Cybersecurity Incident Response Specialist

Bering Straits Native Corp•Washington DC, DC

1d•Onsite

About The Position

Bering Straits Professional Services, LLC is seeking a Senior Cybersecurity Incident Response Specialist to support a client in Washington, DC. The specialist is a member of a Security Operations Center (SOC) team that provides continuous, 24/7/365 monitoring and incident response for network, systems, applications, and web services. This position is on site and requires willingness to work swing or overnight shifts. The role provides senior-level expertise for client incident response processes, develops operational baselines, maintains incident response playbooks and scenarios, and supports ongoing improvements to detection and response capabilities. The work follows NIST SP 800-61, Federal Incident Notification Guidelines, CISA guidance, and client policies. The role requires at least five years of hands-on experience detecting, triaging, and responding to cyber incidents across enterprise networks and cloud environments. A high school diploma or GED is required; a bachelor's degree in computer science or equivalent is preferred. CompTIA Security+ is required. Candidates must be U.S. citizens and must meet eligibility requirements for access to classified information. The position has no supervisory responsibilities. Salary range is $100,000–$120,000. Occasional travel may be required.

Requirements

High school diploma or GED.
At least five years of hands-on experience.
Proven experience detecting, triaging, and responding to cyber incidents across enterprise networks and cloud environments.
Proficiency with SIEM, EDR/XDR platforms, and forensic tools.
Strong understanding of threat actor tactics, techniques, and procedures (TTPs), the MITRE ATT&CK framework, and incident containment strategies.
Ability to analyze network traffic, logs, and endpoint telemetry to identify malicious activity.
Familiarity with malware analysis, reverse-engineering basics, and memory-analysis concepts.
Experience developing and tuning detection rules, playbooks, and automated response workflows.
Working knowledge of incident response frameworks such as NIST SP 800-61 and SANS.
Understanding of vulnerability management, threat intelligence integration, and SOC metrics and reporting.
Understanding of basic computer and networking technologies.
Knowledge of Windows and Linux/Unix operating systems.
Knowledge of networking technologies, including routing, switching, VLANs, subnets, and firewalls.
Knowledge of common network protocols, including SSH, SMB, SMTP, FTP/SFTP, HTTP/HTTPS, and DNS.
Knowledge of enterprise technologies including Active Directory, Group Policy, and Microsoft Azure services.
Understanding of current system-logging technology and how to retrieve information from diverse technology platforms.
CompTIA Security+ certification.
Ability to work well in a team and with little supervision; willingness to adapt to new, open-ended tasks without established procedures.
Ability to research independently and self-teach.
Strong analytical and decision-making skills under pressure.
Excellent written and verbal communication skills, including incident documentation and executive briefings.
U.S. citizenship and eligibility to access classified information; selected applicants are subject to a government security investigation.
Willingness to work on site in Washington, DC and work swing or overnight shifts.
Ability to pass pre-employment drug screening and obtain acceptable background-check results; where applicable, ability to obtain and maintain required clearance levels and access to military installations.

Nice To Haves

Bachelor's degree in computer science or equivalent.
Interest in security or hacking culture and ability to think like an attacker.
One or more preferred cybersecurity certifications: Microsoft AZ-900, CompTIA CySA+, Certified Ethical Hacker (CEH), or GIAC Certified Incident Handler (GCIH).
Cloud security certification, such as CompTIA Cloud+, Certified Cloud Security Professional (CCSP), or Certificate of Cloud Security Knowledge (CCSK).
Microsoft 365 or Azure cybersecurity certification, such as SC-200, SC-900, AZ-900, or AZ-500.
Familiarity with Microsoft 365 and Microsoft Azure products, including Microsoft Sentinel and Microsoft 365 Defender.
Knowledge of Microsoft Sentinel SIEM and Kusto Query Language (KQL).
Knowledge of mobile device technologies, including iOS and Android.
Scripting experience, such as PowerShell or Python.
Experience with Microsoft Power BI and Azure DevOps.
Artificial intelligence and machine learning expertise, including practical application to cyber threat hunting and incident response and experience with AI services offered within Microsoft Azure.

Responsibilities

Provide 24/7/365 SOC monitoring and incident response services for network, systems, applications, and web services.
Provide senior-level cybersecurity incident response expertise in support of client processes and procedures.
Develop operational baselines, including data flows and application interactions, to improve incident response.
Prepare, manage, and continuously review playbooks, scenarios, narratives, and visual diagrams in accordance with NIST and government guidance.
Monitor system status and sensor data, and triage alerts and reports from SIEM, email, text messages, phone calls, and enterprise dashboards.
Analyze network traffic, identity, fault, performance, bandwidth, alert, and other data to identify anomalies and unauthorized activity.
Meet with client stakeholders to develop detection content, analytic rules, alerts, dashboards, and automation, and identify improvements to incident response availability and efficiency.
Categorize, prioritize, and report cybersecurity events in accordance with standard operating procedures and other policies.
Implement cybersecurity mitigations using client tools and systems.
Create and escalate cybersecurity investigations to internal and external entities, including DHS or other government agencies, within client and federal timelines.
Manage and coordinate responses to FOIA requests, audits, data calls, e-discovery, and information requests.
Schedule and conduct annual incident response tabletop exercises for each client FISMA system.
Review and handle phishing messages reported by client staff.
Lead investigations, mentor junior analysts, and collaborate with cross-functional teams.