Senior Incident Handler - Team Lead
About The Position
Peraton is seeking an experienced, mission-driven Cyber Incident Response Team Lead to guide and oversee a dedicated team of Senior Incident Response Analysts. The role provides operational leadership, technical direction, and administrative oversight for cyber incident handling across the GCC Cybersecurity Service Provider (CSSP) mission. The Team Lead serves as the primary operational liaison to supported unit commanders, GCC leadership, NETCOM, and ARCYBER during high-priority incidents, and leads ongoing modernization of incident response playbooks, detection-to-response workflows, and team performance metrics.
Requirements
- Experience requirement varies by education: 5 years with a BS/BA; 3 years with an MS/MA; 7 years with an associate degree; or 9 years without a BS/BA.
- Active Top Secret clearance with SCI eligibility.
- Must possess DoW 8140 DCWF 531 Advanced Certification.
- Deep technical expertise in network- and host-based incident triage, digital forensics integration, SIEM/EDR log correlation, and attack path reconstruction aligned to the MITRE ATT&CK framework.
- Demonstrated experience coordinating incident response within DoD or U.S. Army enterprise architectures, such as NETCOM, ARCYBER, GCC, or DoD CSSP/CIRT environments.
- Thorough understanding of NIST SP 800-61 Rev. 3, DoD 8570/8140 requirements, and CSSP incident reporting timelines.
Responsibilities
- Serve as incident commander or escalation lead for high-severity and complex cyber events, including advanced persistent threats, enterprise ransomware, and insider threat campaigns.
- Coordinate operations among incident response analysts, GCC leadership, supported unit commanders, NETCOM, and ARCYBER; brief general officers and senior executive leadership on incident scope, containment posture, and mission risk.
- Review, validate, and authorize final incident reports, technical analysis summaries, and formal closure documentation before dissemination.
- Ensure team operations comply with NIST SP 800-61 (Rev. 3), CJCSM 6510.01B, DoD/Army CSSP evaluation criteria, and applicable NETCOM/ARCYBER directives.
- Facilitate enterprise-level post-incident reviews and lessons-learned sessions; translate tactical findings into strategic remediation plans, capability requirements, and detection engineering updates.
- Lead the design, validation, and regular execution of tabletop exercises and cyber incident response playbooks covering ransomware, credential access, living-off-the-land techniques, and supply chain compromise.
- Manage analyst training plans, certifications, career pathing, and performance evaluations; foster expertise in digital forensics, memory analysis, and reverse engineering.
- Identify opportunities to optimize workflows, SIEM/EDR integration, and evidence chain-of-custody tracking to reduce mean time to detect and mean time to remediate.
Benefits
- Medical, dental, and vision benefits
- Life insurance
- Health savings account
- Short- and long-term disability
- Employee assistance program (EAP)
- Parental leave
- 401(k)
- Paid time off (PTO) for vacation
- Company-paid holidays
- Employees may be eligible for overtime, shift differential, and a discretionary bonus, depending on the position.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
