Senior Incident Handler - Team Lead
About The Position
Peraton is seeking a mission-driven Cyber Incident Response Team Lead to provide operational leadership, technical direction, and administrative oversight for cyber incident handling across the GCC Cybersecurity Service Provider (CSSP) mission. The role serves as the primary operational liaison to supported unit commanders, GCC leadership, NETCOM, and ARCYBER during high-priority incidents, and leads modernization of incident response playbooks, detection-to-response workflows, and team performance metrics. The team lead manages escalations and complex cyber events, coordinates incident communications with senior military and executive leaders, reviews and authorizes incident reports and closure documents, and ensures operations comply with applicable NIST, DoD, Army CSSP, NETCOM, and ARCYBER requirements. The role also drives post-incident reviews, remediation planning, tabletop exercises, analyst development, and improvements to incident response tooling and processes.
Requirements
- Experience requirement: 5 years with a BS/BA; 3 years with an MS/MA; 7 years with an associate degree; or 9 years without a BS/BA.
- Active Top Secret clearance with SCI eligibility.
- DoW 8140 DCWF 531 Advanced Certification.
- Deep technical expertise in network- and host-based incident triage, digital forensics integration, SIEM/EDR log correlation, and attack-path reconstruction aligned to the MITRE ATT&CK framework.
- Demonstrated experience coordinating incident response in DoD or U.S. Army enterprise architectures, such as NETCOM, ARCYBER, GCC, or DoD CSSP/CIRT environments.
- Thorough understanding of NIST SP 800-61 Rev. 3, DoD 8570/8140 requirements, and CSSP incident reporting timelines.
Responsibilities
- Serve as incident commander or escalation lead for high-severity, complex cyber events, including advanced persistent threats, enterprise ransomware, and insider threat campaigns.
- Coordinate incident response among analysts, GCC leadership, supported unit commanders, NETCOM, and ARCYBER; brief general officers and senior executive leadership on incident scope, containment posture, and mission risk.
- Review, validate, and authorize final incident reports, technical analysis summaries, and formal closure documentation before dissemination.
- Ensure team operations adhere to NIST SP 800-61 (Rev. 3), CJCSM 6510.01B, DoD/Army CSSP evaluation criteria, and applicable NETCOM/ARCYBER directives.
- Facilitate enterprise-level post-incident reviews and lessons-learned sessions, translating findings into remediation plans, capability requirements, and detection engineering updates.
- Lead design, validation, and regular execution of tabletop exercises and cyber incident response playbooks for ransomware, credential access, living-off-the-land techniques, and supply chain compromise.
- Manage analyst training plans, certifications, career pathing, and performance evaluations; foster expertise in digital forensics, memory analysis, and reverse engineering.
- Identify opportunities to improve workflows, SIEM/EDR integration, and evidence chain-of-custody tracking to reduce mean time to detect and remediate.
Benefits
- Medical insurance
- Dental insurance
- Vision insurance
- Life insurance
- Health savings account
- Short- and long-term disability
- Employee assistance program (EAP)
- Parental leave
- 401(k)
- Paid time off for vacation
- Company-paid holidays
- Employees may be eligible for overtime, shift differential, and a discretionary bonus, depending on the position.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
