24/7 Cyber Incident Response Lead (Tier 2)

AGR LLC; Beltsville (MD); On-site; USD 120,000 - 180,000; Full time

Job summary

AGR LLC in Beltsville, MD seeks a Tier 2 Cyber Incident Response Team (CIRT) Shift Lead to join the Federal Strategic Cyber Mission program. You will detect, classify, and report on cyber events in a 24x7 environment, analyzing logs from multiple sources and coordinating remediation with government partners.

The role requires a Bachelor’s degree with extensive incident response experience or higher, active Secret clearance, and relevant certifications.

Qualifications

• Bachelor’s or higher with 9+ years experience, or Master’s with 7+ years, or PhD with 4 years.
• Active Secret clearance required at start; maintain as a condition of employment.
• Certifications such as CASP+ CE; CCNA Cyber Ops; CCNA-Security; CCNP Security; CEH; CISA; CISSP, etc.
• Experience across the incident response lifecycle and with SOAR/SIEM/EDR.
• Knowledge of MITRE ATT&CK and D3FEND frameworks.

Responsibilities

• Detect, classify, process, track, and report on cyber security events and incidents.
• Analyze logs from multiple sources and identify anomalies for containment.
• Coordinate remediation actions with CIRT Watch Officers and government leadership.
• Lead Tier 2 shift tickets, provide technical guidance, and improve processes.
• Collaborate with other CIRTs and monitor SOAR platforms and workflows.

Skills

Incident response

SOAR platforms

SIEM

EDR

Cloud security monitoring

Threat intelligence

Malware analysis

MITRE ATT&CK

Team leadership

Clearance management

Education

Bachelor’s degree in a related field

Master’s degree

PhD

Equivalent experience

Tools

Splunk

Microsoft Sentinel

Elastic

QRadar

ServiceNow SOAR

KAPE

Volatility

Autopsy

Magnet Forensics

Zimmerman Tools

CyLR

Python

PowerShell

Bash

Azure

Defender for Endpoint

Job description

AGR LLC in Beltsville, MD seeks a Tier 2 Cyber Incident Response Team (CIRT) Shift Lead to join the Federal Strategic Cyber Mission program. You will detect, classify, and report on cyber events in a 24x7 environment, analyzing logs from multiple sources and coordinating remediation with government partners.

The role requires a Bachelor’s degree with extensive incident response experience or higher, active Secret clearance, and relevant certifications.