Senior Incident Responder

Revolutional, LLC • New Carrollton, MD

15h • $130,000 - $170,000 • Onsite

About The Position

Revolutional is seeking a Senior Incident Responder to serve as task lead for incident analysis in a 24x7x365 Security Operations Center supporting a large federal agency. This seasoned technical contributor analyzes suspected cybersecurity incidents to determine their nature, scope, severity, likely cause, affected assets, and operational impact, and recommends response actions. The role leads incident responders conducting this work and collaborates with internal experts on deep analyses.

The successful candidate leads incident analysis from initial evidence through recommended response, delivers clear and well-supported findings and timelines, turns lessons learned into improvements to monitoring, triage, and escalation, and guides and develops incident responders. The position is full-time and onsite in New Carrollton, Maryland, or Memphis, Tennessee, with onsite presence at client facilities as directed. Travel is listed as 0%. A Public Trust clearance is required; candidates must be U.S. citizens and able to obtain the clearance.

Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related field and 7+ years of relevant professional experience; three years of additional relevant experience may be substituted for a degree.
• Seasoned technical individual contributor, fully proficient in applying technical principles, theories, and concepts in the field.
• Ability to develop solutions to difficult or unclear technical problems and issues requiring deep technical knowledge.
• Deep understanding of the principles, theories, and concepts of the technical domain, with broad understanding of related specialty areas.
• Experience performing in-depth incident analysis in large enterprise environments, including log analysis and IOC correlation.
• Expertise with SIEM, EDR, and network security monitoring tools.
• Working knowledge of NIST SP 800-61 and the MITRE ATT&CK framework.
• Must be a U.S. citizen and able to obtain a Public Trust clearance.

Nice To Haves

• Experience supporting federal government contracts as a contractor, including working to contract performance standards, deliverable schedules, and government review and approval processes.
• Certifications such as GCIH, GCIA, GCFA, or CISSP.
• Experience analyzing incidents in AWS and Microsoft Azure/M365 environments.
• Experience with SOAR playbooks and automation.

Responsibilities

• Serve as task lead for incident analysis, assigning and reviewing the work of incident responders.
• Analyze suspected incidents to identify relevant activity, affected systems, indicators of compromise, timelines of events, and potential impact.
• Correlate data from logs, alerts, artifacts, reports, threat intelligence, and other approved sources.
• Document analytical findings, confidence levels, supporting evidence, and recommended response or remediation actions in Incident Analysis Reports.
• Coordinate analysis with client IT organizations, other contractors, vendors, and authorized stakeholders as directed.
• Support federal and organizational incident reporting requirements as directed.
• Use incident findings and lessons learned to improve monitoring, triage, escalation, and analysis procedures.
• Guide and develop incident responders.

Benefits

• Traditional and HSA-eligible medical insurance plans.
• 100% employer-paid dental and vision insurance options.
• 100% employer-sponsored short-term disability, long-term disability, and life insurance.
• 5% 401(k) company matching.
• Flexible schedules and teleworking options.
• Paid holidays and PTO accrual plans.
• Paid parental leave.
• Professional development and career growth opportunities.
• Team and company-wide events, recognition, and appreciation.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior