Incident Commander, Tier 3

This is a fully remote position, open to applicants in United States.

📋 Description

• Perform comprehensive incident response analysis to uncover attack vectors, evaluate threats, and investigate malware, data breaches, phishing, social engineering, and various cybersecurity incidents.

• Oversee activities for incident containment, remediation, and recovery.

• Monitor and assess security events and alerts utilizing Splunk SIEM and other security tools.

• Evaluate escalated alerts and conduct Level 3 incident triage to ascertain incident type, severity, scope, risk, and appropriate response or escalation.

• Act as the main point of contact for incident management during significant incidents, including data breaches and ransomware attacks.

• Delegate response actions and coordinate stakeholders, enterprise teams, resources, and timelines.

• Create, maintain, and monitor incident records and ticket queues from detection to closure.

• Ensure precise documentation and adherence to federal requirements, departmental policies, and relevant legislation.

• Assess and suggest technical, procedural, and physical security measures.

• Compile incident status reports, executive briefings, and post-incident analyses.

• Document findings, response actions, remediation efforts, recovery steps, lessons learned, and restoration of normal operations.

• Collaborate with digital forensic investigators and application security analysts on threat investigations and hunting.

• Conduct or coordinate endpoint, network, and log analysis to identify indicators of compromise, determine incident scope, and facilitate root-cause analysis.

• Lead a 24/7 incident coordination operation and communicate incidents to Federal leadership.

⛳️ Requirements

• An active CISSP certification from ISC2, along with GCIH or an equivalent relevant certification in incident response, digital forensics, or cybersecurity is required.

• At least 7 years of relevant professional experience, or a bachelor’s degree with a minimum of 3 years of relevant experience.

• U.S. citizenship is mandatory.

• Must successfully complete a federal background investigation for a High-Risk Public Trust position, including applicable credit checks.

• Extensive experience in managing cybersecurity incidents, advanced incident triage, response coordination, and resolution investigations.

• Proficient in SOC operations, threat hunting, intrusion detection and prevention, security event monitoring, and incident detection and response.

• In-depth knowledge of TCP/IP protocols, network traffic analysis, IDS/IPS, and security log analysis.

• Experience with endpoint security solutions, antivirus, EDR, host-based intrusion detection, firewalls, proxies, WAF, and enterprise security solutions, including FireEye products.

• Strong background in analyzing and correlating security logs and gathering host, network, and cloud data.

• Solid understanding of Windows and Unix/Linux systems, enterprise networking, system and application security, systems and network administration, and OS hardening.

• Knowledge of digital forensic techniques, evidence collection, recovery, preservation, chain of custody, and forensic image acquisition.

• Familiarity with cyberattack stages, adversary techniques, threat profiling, intrusion detection, and indicators of compromise.

• Experience in tracking incident investigations, preparing security alert notifications, maintaining incident records, and documenting response actions.

• Background in supporting or advising on FISMA, PCI DSS, GDPR, NIST, and ISO standards.

• Understanding of CND policies, procedures, standards, and regulatory requirements.

• Ability to coordinate incident response teams and convey mitigation strategies to senior business leaders.

• Competence in communicating complex cybersecurity findings to both technical and non-technical stakeholders during emergencies.

• Exceptional written and verbal communication, presentation, facilitation, documentation, and organizational skills.

• Strong proficiency in Splunk SIEM, Microsoft Defender EDR, Palo Alto Networks Cortex XSOAR, and digital forensic and incident response tools.

• Willingness to work core business hours in alignment with colleagues and clients.

• Must disclose any current or future outside employment and secure written approval.

🏝️ Benefits

• Valiant covers 99% of Medical, Dental, and Vision Coverage for Full-time Employees.

• Valiant contributes 25% towards Health Coverage for Family and Dependents.

• 100% Paid Short Term Disability and Life Insurance Policy for Full-time Employees.

• 100% Paid Certifications.

• 401K Matching up to 4%.

• Paid Time Off.

• Paid Federal Holidays.

• Wellness & Fitness Program.

• Valiant University – Online Education and Training Portal.

• FSA programs for Medical Costs, Dependent Care, Transit, and Parking.

• Referral Bonuses.

• 100% remote work.

• Quiet, distraction-free remote workspace with adequate internet requirements.

• Cameras encouraged and may be required during virtual video conferences.