Incident Detection and Response Manager (Lead) - Remote

S2i2 Inc; Washington (District of Columbia); Remote; USD 130,000 - 160,000; Full time

Benefits offered by this job

Certifications support

Accessible leadership

Team-building events

Client networking

Veteran support

Job summary

S2i2 is seeking an Incident Detection and Response Manager (Lead) to head incident response for a high-security environment, with a strong focus on automation and governance. This role requires US citizenship and the ability to obtain a Public Trust clearance, and offers a flexible, primarily remote work model with periodic headquarters meetings in Washington, DC.

The position combines incident response leadership with engineering efforts to codify playbooks, automate detection, containment and

Qualifications

• Ten+ years in cybersecurity with 5+ years leading incident response for a federal agency or regulated enterprise.
• Demonstrated incident command experience covering containment, eradication, recovery, RCA and executive communication.
• Hands-on automation of incident response using SOAR, scripted playbooks (Python), API integration with SIEM and CI/CD pipelines.
• Working knowledge of NIST SP 800-53 Rev 5, NIST SP 800-61, RMF, and FISMA reporting requirements.
• Experience with Splunk or equivalent SIEM and with AWS.
• US citizen, able to obtain Department of Education High Risk Public Trust.
• Able to document measurable outcomes: MTTD/MTTR, incidents handled, SLAs, automation coverage, audit findings.

Responsibilities

• Serve as the named Key Personnel lead for incident detection and response; substitution requires government approval.
• Own the incident response plan, playbooks, escalation paths and communications; align to NIST/SP policies.
• Meet SLAs for P1 notification, breach reporting, restoration, RCA, and deliver weekly monitoring reports.
• Design, build and maintain Incident Response as Code playbooks; version-controlled in GitLab, deployed via CI/CD.
• Integrate automation with Splunk, Tenable, Qualys; minimize manual evidence collection where feasible.
• Represent the program at daily SOC meetings; communicate incidents, health, outages to senior leadership.
• Coordinate breach response for IHE and GLBA; liaise with Privacy and Safeguards on PII/Federal Tax Information.
• Lead a small team of IR analysts; mentor on response discipline and automation practices.
• Contribute to Zero Trust gap reduction and continuous ATO from IR perspective.

Skills

Incident response leadership

Automation of IR

NIST SP 800-53 Rev 5

AWS experience

PII handling in high-security env

FISMA High / FedRAMP High experience

Public Trust readiness

Measurable outcomes documentation

Tools

GitLab CI

Jira

Confluence

CI/CD pipelines

Splunk

Tenable

Qualys

Job description

Job Title: Incident Detection and Response Manager (Lead)

Location: Primarily remote. Headquarters, Washington, DC, for meetings, audits and inspections.

Clearance: US citizenship is required. Must be able to obtain a Public Trust clearance.

Salary: $130K-$160K

Application Deadline: October 21, 2026

Description

The Incident Detection and Response Manager IV leads incident response for our client's Risk Management program and owns the Incident Response as Code workstream under the program's Everything as Code modernization. The position has 2 halves that must be demonstrated on resume

The 1st half is incident response management. The customer is a FISMA High environment holding the personal and financial data of tens of millions of borrowers and Federal Tax Information under IRS Publication 1075. The program carries hard service levels: notify client within 15 minutes of discovering a critical incident, report any actual or suspected PII breach within 1- hour of discovery, restore service for critical incidents within 4 hours, and deliver a root cause analysis within 5 business days. The lead presents at the daily program Security Operations Center meeting, coordinates with the Government ISSOs, the Privacy Advocate and the Department SOC, and supports breach response for Institutions of Higher Education under GLBA.

The 2nd half is engineering. Candidate must be able to automate classification, notification, containment and evidence capture through codified playbooks and triggers, with an initial Incident Response as Code playbook library due 120 days after award and refreshed annually. The lead designs those playbooks, builds them in Client's GitLab and AWS environment, integrates them with Splunk, Tenable and Qualys telemetry, and ties incident triggers to the safeguard thresholds defined elsewhere in the program. Everything built is delivered to the Government with unlimited rights and must be reproducible from version control.

Responsibilities

• Serve as the named Key Personnel lead for incident detection and response; the Government must approve any substitution.
• Own the incident response plan, playbooks, escalation paths and communications for the program, aligned to NIST SP 800-61, ED OCIO-14 incident reporting procedures and local policy.
• Meet contract SLAs for P1 notification (15 minutes), breach reporting (1 hour), critical incident restoration (4 hours) and RCA delivery (5 business days), and deliver the weekly monitoring and incident report.
• Design, build and maintain the Incident Response as Code playbook library: automated classification, notification, containment and evidence capture, version controlled in GitLab, deployed through CI/CD pipeline, with automated triggers aligned to safeguard thresholds.
• Integrate incident automation with Government furnished telemetry (Splunk, Tenable, Qualys), the GRCT compliance repository and PowerBI dashboards; eliminate manual evidence collection where automation is feasible.
• Represent the program at the daily SOC meeting: active incidents and investigations, system health, escalations, planned outages and items for senior leadership.
• Support IHE and GLBA breach response and outreach, and coordinate with the Privacy and Safeguards functions on incidents involving PII or Federal Tax Information.
• Lead a small team of incident detection and response analysts; mentor on both response discipline and automation practice.
• Contribute to the program's Zero Trust gap reduction, continuous monitoring and continuous ATO objectives from the incident response perspective.

Required qualifications

• Ten or more years in cybersecurity with at least five years leading incident response or security operations for a federal agency or a comparably regulated enterprise. Level IV on the BPA labor category; the Government will judge the resume against that level.
• Demonstrated incident command experience: leading response to real incidents end to end, including containment, eradication, recovery, root cause analysis and executive and regulator communication.
• Hands on automation of incident response: SOAR platforms, scripted playbooks (Python preferred), API integration with SIEM and vulnerability tooling, infrastructure or policy as code in Git with CI/CD. The resume must show something the candidate built, not only something they managed.
• Working knowledge of NIST SP 800-53 Rev 5, NIST SP 800-61, the NIST Risk Management Framework, FISMA reporting and federal breach notification requirements (OMB M-17-12 or successor).
• Experience with Splunk or an equivalent enterprise SIEM, and with AWS.
• Experience with FISMA High or FedRAMP High environments and with PII at scale.
• US citizen, able to obtain a Department of Education High Risk Public Trust determination.
• Able to document measurable outcomes: mean time to detect and respond, incidents handled, SLA attainment, automation coverage, audit findings closed.

Preferred qualifications

• CISSP plus one of GCIH, GCFA, GCIA, GNFA or CISM.
• Experience with OSCAL, policy as code (OPA or similar), GitLab CI, and Atlassian Jira and Confluence.
• Experience applying LLM or agentic AI tooling to triage, enrichment or evidence capture, with an understanding of federal AI governance requirements.
• Experience with Zero Trust implementation under OMB M-22-09 and with continuous ATO programs.
• Experience supporting higher education institutions or financial services partners on breach response under GLBA.

About S2i2

S2i2 is a growing company with a supportive and inclusive culture and many opportunities for professional development and growth. We have created a supportive, family-like work environment where contributions are recognized. Regular company updates and open lines of communication with leadership fosters collaboration within the company.

We are proud to include:

• Support to achieve professional certifications and degrees
• Leadership that is accessible to all employees
• Regular company updates
• Client networking social engagements
• Monthly team-building activities (past examples: Top Golf)
• Supporting our community - including veterans

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, disability, age, sexual orientation, gender identity, national origin, veteran status, or genetic information.