Incident Management Lead

Crest Security Assurance; Alexandria (VA); Hybrid; USD 140,000 - 190,000; Full time

Job summary

Crest Security Assurance seeks an Incident Management and Response Lead to oversee enterprise cybersecurity incidents from detection through recovery, based in Alexandria, VA, with a hybrid onsite schedule.

The role drives incident response operations, develops NIST-aligned playbooks, and coordinates cross‑functional teams while briefing executives on risk and remediation. U.S. citizenship is required with clearance considerations.

Qualifications

• 10+ years in cybersecurity, incl. 5+ years in incident response leadership.
• Experience coordinating enterprise response, containment, and recovery.
• Hands-on with forensic analysis tools and MITRE ATT&CK.
• Familiarity with federal standards and incident reporting.

Responsibilities

• Lead enterprise incident response operations and post-incident analysis.
• Develop IR Plans, CONOPS, SOPs, and playbooks aligned with NIST SP 800-61.
• Direct investigations using SIEM, SOAR, EDR/XDR and forensic tools.
• Coordinate digital forensics, containment, and remediation across teams.
• Lead major incident response and crisis management, interfacing with leadership and external bodies.
• Produce reports, root cause analyses, and executive briefings.

Skills

Incident response leadership

Digital forensics

Threat hunting

MITRE ATT&CK

Tabletop exercises

Executive briefings

Crisis management

Cross‑functional leadership

Coordination with Govt/External teams

Education

Master's degree in Cybersecurity/related field

Tools

SIEM

SOAR

EDR/XDR

Digital forensic tools

Splunk

Microsoft Defender

Wireshark

Volatility

Job description

Incident Management and Response Lead Position (US Citizenship Required)

Leads enterprise cybersecurity incident management and response operations, overseeing incident detection, investigation, analysis, containment, eradication, and recovery. Directs incident coordination, digital forensics, threat intelligence integration, and response activities to minimize operational impact and strengthen enterprise cyber resilience.

Key Responsibilities

• Lead enterprise incident response operations, including incident triage, classification, investigation, containment, eradication, recovery, and post-incident analysis.
• Develop, maintain, and execute Incident Response Plans, CONOPS, SOPs, escalation procedures, and technical playbooks aligned with NIST SP 800-61 and applicable federal requirements.
• Direct incident investigations using SIEM, SOAR, EDR/XDR, network traffic analysis, endpoint telemetry, and digital forensic tools, including Splunk, Microsoft Defender, Wireshark, Volatility, and approved forensic platforms.
• Coordinate digital forensics and incident analysis involving malware, compromised endpoints, credential theft, lateral movement, unauthorized access, data exfiltration, and advanced persistent threats.
• Apply MITRE ATT&CK tactics, techniques, and procedures (TTPs) to investigate adversary activity, reconstruct attack timelines, identify root causes, and determine incident scope and impact.
• Lead major incident response and crisis management, coordinating SOC analysts, threat hunters, system owners, cybersecurity engineers, Government leadership, and external response organizations.
• Develop and execute containment and remediation strategies, including endpoint isolation, credential revocation, malicious artifact removal, vulnerability mitigation, and secure restoration of affected systems.
• Integrate cyber threat intelligence, indicators of compromise (IOCs), threat hunting, and detection engineering to accelerate investigations and prevent recurring incidents.
• Conduct incident response tabletop exercises, technical simulations, and purple team activities to validate playbooks, escalation procedures, response readiness, and operational effectiveness.
• Manage incident documentation, evidence preservation, chain of custody, incident tracking, and required federal cybersecurity reporting and notification timelines.
• Produce incident reports, root cause analyses, after-action reports, executive briefings, and risk-based corrective action recommendations.
• Establish incident response performance metrics, including MTTD, MTTR, containment effectiveness, and incident trends, to drive continuous operational improvements.

Required Qualifications

• Master's degree in Cybersecurity, Computer Science, Information Technology, or a related field.
• 10+ years of cybersecurity experience, including 5+ years leading enterprise incident response or SOC operations.
• Demonstrated expertise in digital forensics, malware analysis, threat hunting, incident investigation, and enterprise containment and recovery.
• Hands-on experience with SIEM, SOAR, EDR/XDR, forensic analysis tools, and MITRE ATT&CK.
• Proven ability to lead high‑severity cyber incidents, coordinate cross‑functional response teams, and brief executive leadership.

Preferred Qualifications

• Experience supporting federal cybersecurity operations in complex enterprise environments.
• Familiarity with NIST SP 800-61, NIST SP 800-53, FISMA, RMF, and federal incident reporting requirements.
• Experience with cloud incident response, adversary emulation, incident response automation, and threat intelligence integration.
• GCIH, GCFA, GCFE, CISSP, or equivalent incident response certification.

Clearance Requirements

Must be a U.S. Citizen; Public Trust or higher clearance required.

Hybrid role based in Alexandria, VA. Initial 30 days onsite, followed by 2-3 days onsite per week.