Seven or more years of cybersecurity experience, particularly in SOC and incident response roles.
Proven problem-solving skills through deep analysis and collaboration.
Hands-on experience with enterprise SIEM and endpoint security technologies.
Strong documentation and briefing skills, distinguishing facts from interpretations.
Willingness to work a 24x7 shift and provide after-hours support as needed.
Responsibilities
Lead SOC shift activities, coordinating monitoring and incident response.
Monitor security alerts and logs for malicious activity, assessing severity and impact.
Document and coordinate suspicious activity reports from various sources.
Analyze incidents to identify affected systems and indicators of compromise.
Correlate various data sources to develop defensible findings.
Document evidence and recommended remediation actions clearly.
Mentor junior analysts and contribute to operational improvements.
Benefits
Hybrid work environment with regular onsite presence.
Opportunities for professional development and mentorship.
Participation in exercises and continuity activities.
Supportive team culture focused on continuous improvement.
Full Job Description
Incident Response Lead
Position Overview
The Incident Response Shift Lead is a senior analyst responsible for real-time monitoring, triage, incident intake, investigation, coordinated response, shift execution, and analyst mentoring. The role leads an assigned shift, manages urgent technical work, maintains clear operational handoffs, and develops defensible conclusions from incomplete or ambiguous evidence across on-premises and cloud environments.
Duties & Responsibilities
Lead an assigned SOC shift and coordinate monitoring, triage, incident intake, investigation, escalation, and response activities.
Monitor alerts, logs, events, and security data for anomalous or malicious activity and determine severity, impact, and required escalation.
Receive, review, document, and coordinate suspicious-activity and incident reports from authorized internal and external sources.
Perform incident analysis to identify relevant activity, affected systems, indicators of compromise, event timelines, likely cause, severity, scope, and operational impact.
Correlate alerts, logs, endpoint data, network data, cloud telemetry, threat intelligence, artifacts, and prior cases to develop defensible findings.
Document evidence, confidence levels, analytical judgments, unresolved questions, and recommended response or remediation actions.
Recommend and support containment, eradication, recovery, and post-incident improvement activities with system and service owners.
Create, update, and maintain accurate incident records and support closure only after required remediation, coordination, and documentation are complete.
Conduct disciplined shift handoffs covering open incidents, pending notifications, degraded tools or feeds, approvals, risks, and deadline-sensitive actions.
Operate and troubleshoot assigned SOC tools and escalate platform or engineering problems through the designated technical lead.
Mentor junior analysts, review work products, reinforce procedures, and contribute to lessons learned and playbook improvements.
Participate in exercises, continuity activities, and surge operations as assigned.
Qualifications
Minimum Requirements:
Seven or more years of cybersecurity experience, including substantial hands-on SOC, incident-response, cyber-defense, or threat-analysis work.
Demonstrated ability to solve difficult or unclear technical problems through deep analysis and collaboration with internal experts.
Hands-on experience with enterprise SIEM, endpoint security, network-security monitoring, and case-management technologies.
Strong incident documentation and briefing skills, including the ability to distinguish facts, interpretations, and unresolved questions.
Ability to work an assigned 24x7 shift and support after-hours coverage as required.
Preferred Qualifications:
Five or more years in a 24x7 SOC or incident response center, including experience as a shift lead or senior analyst.
Experience investigating incidents across on-premises, AWS, Azure, Microsoft 365, identity, endpoint, and network environments.
Working knowledge of widely used incident-response and federal incident-notification guidance.
Demonstrated ability to communicate clearly with technical and customer leads during high-priority events.
What Success Looks Like
Alerts and incident reports receive timely, consistent, evidence-based triage and escalation.
Investigations produce clear timelines, scope, impact, findings, and recommended actions.
Shift handoffs preserve continuity and leave no ambiguity about ownership, status, or next action.
Junior analysts improve through direct coaching, quality review, and practical operational guidance.
Education and Certifications:
Minimum: Bachelor's degree in cybersecurity, computer science, information systems, engineering, or a related field; additional relevant experience may be considered in lieu of a degree.
Clearance Level:
Active Secret clearance required.
Work Location
Hybrid federal customer environment. Regular onsite presence and periodic travel between supported operating locations may be required.
Hours of Operation
Assigned 24x7 SOC shift, which may include days, nights, weekends, and holidays. Participation in on-call and non-regular-duty coverage may be required.
Ability to pass a minimum background investigation.
