Cyber Incident Response Lead (Public Sector, On-Call)

Department of Behavioral Health and Developmental Services; Richmond (VA); On-site; USD 85,000 - 106,000; Full time

Job summary

Department of Behavioral Health and Developmental Services in Virginia seeks an Information Security Officer to lead the agency’s incident response program. You will coordinate with VITA, oversee incidents from detection to closure, and guide remediation and reporting while protecting PHI and agency operations.

You will orchestrate cross‑functional responses to malware, phishing, data loss, insider threats, and other security events, provide guidance to staff, and support audits, tabletop

Qualifications

• Experience leading or coordinating cybersecurity incident response in a large enterprise, government, healthcare, or public sector.
• Knowledge of the cybersecurity incident lifecycle (identification to closure).
• Experience responding to ransomware, phishing, data loss, PHI/PII breaches, and related events.
• Ability to analyze security alerts, logs, and threat intel to drive actions.
• Experience supporting forensic investigations and chain-of-custody documentation.

Responsibilities

• Lead the agency’s incident response program and coordinate with VITA and other stakeholders.
• Oversee incidents from identification through triage, containment, eradication, recovery, remediation, and closure.
• Prepare incident documentation, timelines, reports, and executive briefings; provide guidance on reporting and evidence handling.

Skills

Incident response coordination

Security incident lifecycle

Threat & vulnerability analysis

Forensic support

Communication under pressure

Education

CISSP

CISM

Security+

Tools

ServiceNow

SIEM

Forensic tools

Job description

Department of Behavioral Health and Developmental Services in Virginia seeks an Information Security Officer to lead the agency’s incident response program. You will coordinate with VITA, oversee incidents from detection to closure, and guide remediation and reporting while protecting PHI and agency operations.

You will orchestrate cross‑functional responses to malware, phishing, data loss, insider threats, and other security events, provide guidance to staff, and support audits, tabletop