Cyber Defense Incident Responder - Overnight ShiftCyber Defense Incident Responder - Overnight Shift

ASRC Federal; Quantico (VA); On-site; USD 120,000 - 170,000; Full time

Job summary

ASRC Federal at Quantico, VA seeks a Cyber Incident Responder for the overnight shift (2100–0700) with weekend/holiday coverage. This fully on-site role requires no telework and involves detecting, triaging, containing, and eradicating cyber threats across the enterprise using SIEM, SOAR, CrowdStrike, CyberArk, and ESS.

The ideal candidate has 2+ years of incident response experience, DoD guidance familiarity, a BS in IT/Cybersecurity, and a TS clearance; DoD 8570 IAT Level II certification is

Qualifications

• Minimum two years of hands-on cybersecurity incident response experience.
• Knowledge of DoD cybersecurity policies and guidelines (NIST SP 800-61, STIGs, A&A).
• Must have active Top Secret clearance and be eligible for TS/SCI upgrade.

Responsibilities

• Detect, triage, contain, and eradicate incidents in real time.
• Coordinate recovery efforts and preserve forensic evidence.
• Maintain and update incident response playbooks and SOPs.
• Prepare and deliver incident reports and trend summaries.

Skills

Incident Detection & Triage

Incident Response Lifecycle

Containment & Eradication

Investigation & Forensics

Malware Analysis

Reporting & Escalation

Cyber Task Management

Strong Communication

Education

Bachelor’s degree in IT / Cyber Security

Active Top Secret Clearance

DoD 8570 certification (IAT Level II)

Tools

SIEM

SOAR

CrowdStrike

CyberArk

Endpoint Security Suite (ESS)

Job description

ASRC Federal is seeking a highly skilled and experiencedCyber Incident Responderto join our dynamic team on theovernight shift (2100 – 0700), providing extended-hours coverage that includesweekend and holiday rotations. This is afully on-site positionat Quantico Marine Corps Base, VA —no telework is available for this role.

The successful candidate will serve as a front-line defender, rapidly detecting, triaging, containing, and eradicating cyber threats across our enterprise infrastructure. This role is critical for minimizing the impact of security incidents, coordinating response actions, and preserving forensic evidence in support of Department of Defense (DoD) missions.

Position Description:

The Cyber Incident Responder is a vital role responsible for executing the full incident response lifecycle duringovernigh-shift, weekend, and holiday coverage windows. This position focuses on detecting and responding to security incidents in real time, performing containment and eradication actions, and coordinating recovery efforts using enterprise tools such asSIEM, SOAR, CrowdStrike, CyberArk, and Endpoint Security Suite (ESS).

The Incident Responder will collaborate with cross-functional IT and security teams to:

• Execute incident response procedures in accordance withNIST SP 800-61and DoD guidelines
• Coordinate with JFHQ-DODIN on cyber incident reporting and remediation
• Support insider threat response and investigations
• Contain and remediate compromised systems, accounts, and endpoints
• Preserve and document forensic evidence for incident case management
• Maintain incident response playbooks and ensure high operational readiness during all covered hours

Minimum Requirements:

• At least two (2) yearsof hands-on technical cybersecurity experience and knowledge of incident response concepts, Computer Network Defense, DISA Security Technical Implementation Guides (STIGs), DoD A&A Process, NIST SP 800-53, NIST SP 800-61, CJCSM 6510.01B, United States Cyber Command guidelines, and other applicable DoD Cyber Security and Computer Network Defense policies.
• Active Top Secret Clearance REQUIRED, eligible to be upgraded to TS/SCI.
• Bachelor’s degreein Information Technology, Information Systems Management, Cyber Security, or equivalent experience.
• Must meetDoD 8570 certification requirements at time of hire—IAT Level II(e.g., CCNA Security, CySA+, GICSP, GSEC, Security+, SSCP);CSIH, GCIH, or GCFA preferredfor incident handling.

Required Skills:

• Incident Detection & Triage:Monitor security alerts and events from SIEM, EDR, IDS/IPS, firewall, DNS, and ESS sources to rapidly detect, triage, and prioritize potential security incidents.
• Incident Response Lifecycle:Execute the full incident response lifecycle — preparation, detection and analysis, containment, eradication, recovery, and post-incident activity — in accordance with NIST SP 800-61.
• Containment & Eradication:Take decisive containment and eradication actions on compromised endpoints, accounts, and systems to limit incident impact.
• Cyber Task Management:Process and handleJFHQ-DODINcyber-related tasks, orders, and incident reporting requirements to completion within required timelines.
• Investigation & Forensics:Identify evidence of illegal activity involving cybercrime offenses; examine computers potentially involved in crime or malware infection and preserve forensic evidence following chain-of-custody procedures.
• Malware Analysis:Use forensic tools and investigative methods to identify, isolate, and analyze specific electronic data associated with complex malware infections.
• Incident Documentation:Develop and maintain incident response playbooks, standard operating procedures (SOPs), and detailed incident case documentation.
• Reporting & Escalation:Provide timely incident reports and escalations to senior leadership and deliver daily/weekly/monthly summaries on incident trends and key indicators of network security.

Work Environment and Physical Demands:

• This is afully on-site positionat DCSA facilities, Quantico Marine Corps Base, VA.Telework is not offered for this shift.
• Must work the assignedOvernight shift (2100 – 0700)and supportweekend and holiday coverageas scheduled consisting of Four 10-hour shifts per work week.
• Must be able to communicate complex technical ideas to a diverse customer base, both verbally and in written form.