Incident Commander, Tier 3

This is a fully remote position, open to applicants in United States.

📋 Description

• Perform advanced analysis of incident responses to identify attack vectors, evaluate threats, and investigate incidents involving malware, data exposure, phishing, social engineering, and other cybersecurity matters.

• Organize activities related to incident containment, remediation, and recovery.

• Monitor and assess security events and alerts using Splunk SIEM and various other security tools.

• Review escalated alerts and conduct Level 3 incident triage to ascertain the incident type, severity, scope, risk, and necessary response or escalation.

• Act as the primary coordination point for incident management during major incidents, including data breaches and ransomware events.

• Delegate response actions and coordinate with stakeholders, enterprise teams, resources, and timelines.

• Create, maintain, and monitor incident records and ticket queues from detection to resolution.

• Ensure precise documentation and adherence to federal mandates, departmental policies, and relevant legislation.

• Assess and suggest technical, procedural, and physical security controls.

• Prepare incident status reports, executive summaries, and post-incident analyses.

• Document findings, response actions, remediation steps, recovery, lessons learned, and the restoration of normal operations.

• Collaborate with digital forensic investigators and application security analysts during investigations and threat hunting activities.

• Conduct or coordinate analyses of endpoints, networks, and logs to identify indicators of compromise, gauge incident scope, and support root-cause analysis.

• Lead a continuous incident coordination function available 24/7, and communicate incidents to Federal leadership.

⛳️ Requirements

• U.S. citizenship is mandatory.

• Must successfully pass a federal background investigation for a High-Risk Public Trust position, including relevant credit checks.

• Ability to obtain and maintain a Public Trust designation.

• Must possess an active CISSP certification from ISC2, along with GCIH (GIAC Certified Incident Handler) or an equivalent certification related to incident response, digital forensics, or cybersecurity.

• At least 7 years of pertinent professional experience, or a bachelor’s degree with a minimum of 3 years of relevant experience.

• Extensive experience in managing cybersecurity incidents, advanced incident triage, coordinating response efforts, and guiding investigations to resolution.

• Proficiency in Security Operations Center (SOC) operations, threat hunting, intrusion detection and prevention, security event monitoring, and incident detection and response.

• Advanced knowledge of TCP/IP protocols, network traffic analysis, IDS/IPS, and security log examination.

• Familiarity with endpoint security, antivirus solutions, EDR, host-based intrusion detection systems, firewalls, proxies, WAF, and enterprise security solutions, including FireEye products.

• Experience in analyzing and correlating security logs and collecting data from hosts, networks, and cloud environments.

• Strong understanding of Windows and Unix/Linux operating systems, enterprise networking, system and application security, systems and network administration, and OS hardening techniques.

• Knowledge of digital forensic methods, including evidence collection, recovery, preservation, chain of custody, and forensic image acquisition.

• Understanding of the stages of cyberattacks, adversary techniques, threat profiling, intrusion detection, and indicators of compromise.

• Experience in creating and tracking incident investigations, preparing security alert notifications, maintaining incident records, and documenting response actions.

• Familiarity with FISMA, PCI DSS, GDPR, NIST, and ISO standards.

• Understanding of Computer Network Defense policies, procedures, standards, and regulatory requirements.

• Ability to coordinate incident response teams, collaborate with senior business leaders, assess risks, and communicate mitigation strategies effectively.

• Skill in conveying complex cybersecurity findings and recommended actions to both technical and non-technical stakeholders during critical situations.

• Excellent written and verbal communication, presentation, facilitation, documentation, and organizational skills.

• Capability to manage multiple investigations and competing priorities simultaneously.

🏝️ Benefits

• A selection of medical plans, ranging from an affordable HSA option to a comprehensive PPO, with generous company contributions.

• Dental and vision insurance for you and your family.

• Company-paid life insurance, short-term disability, and long-term disability insurance.

• Optional supplemental life, accident, and critical illness coverage.

• A 401(k) retirement plan with company matching contributions.

• Paid time off that increases with years of service.

• Paid federal holidays.

• Financial support for certifications.

• Opportunities for professional development.

• Access to the Valiant University training portal.

• Flexible spending accounts available.

• Wellness and fitness programs.

• Referral bonuses.

• Remote work options.

• A quiet, distraction-free workspace with adequate internet requirements for telecommuters.