Type of Requisition:
Regular

Clearance Level Must Currently Possess:
Secret

Clearance Level Must Be Able to Obtain:
Secret

Public Trust/Other Required:
None

Job Family:
Cyber and IT Risk Management

Job Qualifications:

Skills:
Cyber Incident Response, Cyber Operations, Cyber Risks, Data Security, Leadership
Certifications:
None
Experience:
5 + years of related experience
US Citizenship Required:
Yes

Job Description:

Cyber Incident Response Team (CIRT) Lead
Location: Full-time onsite, Falls Church, VA
Clearance: Active SECRET (must be maintained)

GDIT has an opening for a Cyber Incident Response Team (CIRT) Lead supporting the Army National Guard (ARNG). This position is part of an IT Service Management contract that includes the operation, modernization, expansion, and evolution of the ARNG's global IT services. These services span networking, compute, storage, infrastructure, cybersecurity, applications, hosting, and program management. The program operates within the ITIL framework to deliver high-quality IT services to the ARNG, and this leadership role is critical to ensuring the security and success of that mission.

HOW A CIRT LEAD WILL MAKE AN IMPACT

As the CIRT Lead, you will combine hands-on incident response expertise with team leadership responsibilities to guide analysts and coordinate complex cyber operations in support of ARNG.

Lead and Manage the CIRT Team

• Provide day-to-day leadership of CIRT analysts, including tasking, prioritization, and oversight of incident response activities.
• Mentor, coach, and develop team members, including feedback, informal performance guidance, and support for career development.
• Ensure consistent adherence to incident response procedures, quality standards, and timelines.
• Coordinate shift coverage, on-call rotations, and escalation paths to meet mission requirements.
• Serve as the primary point of contact for CIRT-related activities with ARNG stakeholders and other GDIT teams.

Incident Response Operations

• Lead triage of cyber incidents, determining scope, urgency, impact, and recommended courses of action.
• Guide and, when necessary, perform collection and analysis of network/host artifacts (logs, images, packet captures) to identify root cause and operational impact.
• Oversee real-time cyber defense incident handling, ensuring rapid, coordinated response and remediation.
• Direct proactive identification of vulnerabilities and recommend mitigations to reduce risk.
• Demonstrate and validate effectiveness of defenses through coordination with Red Team activities and investigations.
• Ensure cyber defense incidents are managed, documented, and tracked from detection through resolution, with clear, concise reporting.

Process, Documentation, and Training

• Maintain and improve Incident Response tactics, techniques, procedures (TTPs), and training documentation.
• Plan and oversee the delivery of incident response training courses (at least four per calendar year), delegating instruction and ensuring quality content.
• Support efforts to maintain the customer's CSSP accreditation, including documentation, technical writing, and audit support.
• Drive continuous improvement in incident response workflows, tools usage, and reporting.

Stakeholder Communication and Collaboration

• Provide timely briefings and written reports to ARNG leadership and other stakeholders on incident status, trends, and lessons learned.
• Participate in and often lead cross-functional meetings to improve cybersecurity posture across the environment.
• Coordinate closely with engineering, operations, and other cyber defense teams to ensure alignment and effective mitigation of threats.
• Support on-call and after-hours activities as needed, and ensure the team is prepared to respond to time-sensitive events under tight deadlines.

WHAT YOU'LL NEED TO SUCCEED

Education / Equivalent Training

• Bachelor's degree in information technology, computer science, or a related technical discipline; or an equivalent combination of education, technical certifications/training, and relevant work experience.

Required Experience

• 5+ years of practical experience in a cybersecurity, engineering, T&E, or A&A-related field.
• Demonstrated prior experience with cyber incident response on DoW networks and digital forensics.
• Experience in a lead or senior role guiding incident response activities or mentoring junior analysts is strongly preferred.

Technical and Leadership Skills

• Proficiency in collecting and analyzing logs, system images, and other artifacts to investigate and resolve cybersecurity incidents.
• Strong understanding of cybersecurity concepts, mitigation strategies, root cause analysis, and Red Team operations.
• Familiarity with current cyber defense tools and technologies (e.g., SIEM, IDS/IPS, endpoint protection, packet capture tools).
• Excellent oral and written communication skills for both technical and non-technical audiences, including incident reports and briefings.
• Strong organizational skills for multitasking, meeting deadlines, and managing team workload.
• Ability to work independently and lead a team in fast-paced environments, solving complex problems under pressure.
• Collaborative mindset, strong customer service orientation, and ability to build trust and credibility with customers and team members.
• Dependability, punctuality, responsiveness to management, and attention to detail.

Certification Requirements

• Must possess the appropriate baseline certification(s) to achieve at least DoWD 8570.01-M IAT Level II (e.g., CompTIA Security+ CE) prior to start.
• Must obtain an additional computing environment certification within six months of hire based on position designation (e.g., CEH, CCNA-Security, CND, etc.).
• When DoW 8140 requirements are implemented on the program/contract, employees must conform to 8140 certification standards.

Security Clearance

• Active SECRET security clearance required and must be maintained.

The likely salary range for this position is $136,000 - $184,000. This is not, however, a guarantee of compensation or salary. Rather, salary will be set based on experience, geographic location and possibly contractual requirements and could fall outside of this range.

Scheduled Weekly Hours:
40

Travel Required:
Less than 10%

Telecommuting Options:
Onsite

Work Location:
USA VA Falls Church

Additional Work Locations:

Total Rewards at GDIT:
Our benefits package for all US-based employees includes a variety of medical plan options, some with Health Savings Accounts, dental plan options, a vision plan, and a 401(k) plan offering the ability to contribute both pre and post-tax dollars up to the IRS annual limits and receive a company match. To encourage work/life balance, GDIT offers employees full flex work weeks where possible and a variety of paid time off plans, including vacation, sick and personal time, holidays, paid parental, military, bereavement and jury duty leave. To ensure our employees are able to protect their income, other offerings such as short and long-term disability benefits, life, accidental death and dismemberment, personal accident, critical illness and business travel and accident insurance are provided or available. We regularly review our Total Rewards package to ensure our offerings are competitive and reflect what our employees have told us they value most.

Our Identity Verification Process:
As part of the hiring process, we will ask you to complete an identity verification process that leverages advanced biometrics and artificial intelligence to ensure authenticity and protect against identity fraud. You are expected to be on camera during virtual interviews. We reserve the right to take your picture to verify your identity and prevent fraud. By proceeding, you authorize the collection, processing, and use of your biometric data for identity verification and security purposes.