Cloud Defense & Response SME - Incident Response Expert

Sentar; Maryland; On-site; USD 140,000 - 200,000; Full time

Benefits offered by this job

Voluntary Medical, Dental, Vision

Flexible Spending Plan

Life Insurance

Short-Term Disability

Long-Term Disability

401(k) match

Generous PTO

Leave programs

Job summary

Sentar is seeking a Cloud Response SME to support DoD cloud defense in Quantico, VA. The role focuses on acting as the primary technical authority for engineering, optimizing, and maintaining defensive cyberspace operations (DCO) infrastructure across customer cloud environments.

You will design, implement, and maintain high-impact threat detection use cases in cloud environments, leveraging Tanium, Defender for Endpoint, Elastic/Kibana, and JRSS to protect mission-critical systems.

Qualifications

• IAT III and CSSP Incident Responder certifications required.
• At least five years of demonstrated experience in incident investigation in cloud environments.
• Experience with cloud computing environments and defensible cloud security tooling.
• Experience with Tanium, Defender for Endpoint, Elastic/Kibana, and JRSS.
• Clearance TS/SCI eligibility.

Responsibilities

• Develop detection use cases focused on cloud unauthorised activity.
• Assist with investigation and response to cloud cyberspace incidents.
• Assist with design and deployment of new DCO capabilities in cloud environments.
• Demonstrate effectiveness by identifying/preventing Red Team activity in cloud environments.
• annually update TTPs and training documentation.
• Prepare and present a course on Cloud Computing security and DCO topics.

Skills

Cloud security

Incident response

DCO

Tanium

Defender for Endpoint

Elastic/Kibana

JRSS

TTPs

Education

Technical Bachelor's

IAT III certification

CSSP Incident Responder

Tools

Tanium

Microsoft Defender for Endpoint

Elastic/Kibana

JRSS

Job description

Sentar is seeking a Cloud Response SME to support DoD cloud defense in Quantico, VA. The role focuses on acting as the primary technical authority for engineering, optimizing, and maintaining defensive cyberspace operations (DCO) infrastructure across customer cloud environments.

You will design, implement, and maintain high-impact threat detection use cases in cloud environments, leveraging Tanium, Defender for Endpoint, Elastic/Kibana, and JRSS to protect mission-critical systems.