Incident Commander (Tier 3)

Accountabilities

• Advanced Incident Response: Lead Tier 3 investigations into complex cybersecurity incidents, including malware infections, phishing campaigns, ransomware attacks, social engineering, data exposure, and other security threats. Analyze attack vectors, adversary behavior, and indicators of compromise to determine incident severity, scope, and potential impact.

• Incident Command & Coordination: Serve as the primary operational coordinator during significant security incidents, assigning response actions and coordinating enterprise teams, incident responders, stakeholders, resources, and timelines to ensure effective resolution.

• Security Monitoring & Threat Analysis: Review escalated security alerts and analyze events using Splunk SIEM and other security platforms. Perform advanced incident triage, distinguish genuine threats from false positives, and determine appropriate containment, investigation, or escalation measures.

• Containment & Recovery: Coordinate incident containment, remediation, and recovery activities to minimize operational disruption, mitigate risks, and restore affected systems and services.

• Incident Documentation & Reporting: Create, maintain, and track incident records throughout the investigation lifecycle, ensuring accurate documentation and compliance with applicable federal requirements, organizational policies, and reporting procedures.

• Forensic Investigation & Threat Hunting: Collaborate with digital forensic investigators and application security specialists to conduct endpoint, network, and log analysis, identify indicators of compromise, establish incident scope, and support root-cause investigations.

• Security Improvement & Risk Management: Evaluate and recommend technical, procedural, and physical security controls to address vulnerabilities, reduce incident impact, and prevent recurrence.

• Stakeholder Communication: Prepare incident notifications, executive briefings, status updates, and post-incident reports covering investigation findings, response actions, remediation progress, recovery activities, and lessons learned.

• Operational Compliance: Ensure adherence to established standard operating procedures, escalation protocols, security policies, and applicable regulatory requirements, including timely incident notifications to federal leadership.

Requirements

• Professional Experience: At least 7 years of relevant professional experience, or a bachelor's degree combined with at least 3 years of relevant experience.

• Citizenship & Security Eligibility: U.S. citizenship is mandatory due to federal contract requirements. Candidates must be able to successfully complete a federal background investigation for a High-Risk Public Trust position, including applicable credit checks, and obtain and maintain the required Public Trust.