Incident Response Lead/Advisor (Cybersecurity)

Location: Full-time, on-site position in Reston, Virginia, United States

Company

Provides advanced software and systems engineering, research, and technical solutions for the U.S. Federal Intelligence Community.

What you will do

• Advise, mentor, and coach cybersecurity professionals on incident response best practices.
• Identify, analyze, and respond to cyberattacks, data breaches, and system vulnerabilities across diverse networks, platforms, and tools.
• Monitor security logs and network traffic to detect anomalies and advanced intrusions.
• Execute incident response playbooks and conduct digital forensics.
• Collaborate with IT and security teams to mitigate threats and prevent recurrence.
• Advise on security policies, risk management, compliance, and formal incident reporting.

Requirements

• U.S. citizenship and an active TS/SCI clearance with CI Poly are required.
• Bachelor's degree in a relevant field, or a relevant master's degree with qualifying experience.
• At least 8 years of relevant experience, or 6 years with a relevant master's degree.
• DoD 8570 IAT Level II certification, such as CySA+, required within 30 days of contract start.
• Knowledge of cyber adversary tactics, techniques, and procedures; advanced intrusion analysis; basic cybersecurity forensics; and malware analysis reports.
• Strong oral and written communication, technical editing, and formal report production skills.

Nice to have

• CEH, GCIH, or GCIA certification.
• Cyber Mission Force analyst or operator experience.
• Management experience.
• Experience with DoD cybersecurity operations and classified system information assurance.

Culture & Benefits

• Medical insurance cost sharing for employees and dependents.
• Company-paid dental, vision, short-term disability, and long-term disability insurance.
• 401(k) plan with company match and immediate vesting.
• Paid leave and holiday package.
• Tuition and training reimbursement, plus life and AD&D insurance.
• Rotational shifts may be required to support 24x7 coverage.