Incident Responder Shift Lead - Tier 2

Evans & Chambers; Fort Meade (MD); On-site; USD 130,000 - 158,000; Full time

Job summary

Evans & Chambers seeks a Tier 2 Incident Responder – Team Lead to conduct in-depth investigations, containment, and remediation of security incidents escalated from Tier 1. The role requires TS/SCI with CI Poly clearance and leadership of Tier 1 and Tier 2 responders. The position is onsite at Ft.

Meade, MD with 24/7/365 coverage and on-call rotation for after-hours escalation. Bachelor’s in a related field and DoD 8570/8140 IAT Level III or CSSP Incident Responder certs are required; scripting

Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field preferred; 3–5 years of hands-on incident response, digital forensics, or security operations experience.

Responsibilities

• Investigate escalated alerts and incidents through log analysis, malware analysis, and digital forensics to determine scope, root cause, and impact.
• Support containment and eradication actions; assist recovery to a hardened baseline.
• Document incident timelines and findings; track POA&M entries to closure and contribute to after-action reviews.
• Review and remediate findings.
• Provide technical mentorship to Tier 1 Analysts and serve as a secondary escalation point during major incidents.
• Manage personnel workload and daily performance issues.

Skills

Incident response

Digital forensics

Mentorship

Scripting (Python/PowerShell/Bash)

Education

Bachelor's degree in CS/IT/Cybersecurity or related field

Tools

EDR tooling

Packet analysis

Job description

Position Summary

The Tier 2 Incident Responder – Team Lead performs in-depth investigation, containment, and remediation of security incidents escalated from Tier 1, applying the NIST SP 800-61 incident response life cycle and manages Tier 1 Analysts and Tier 2 Incident Responders.

Clearance

TS/SCI with CI Poly

Location

Ft. Meade, MD (Onsite)

Work Schedule and Conditions

Primary shift assignment within the 24/7/365 coverage model with participation in an on‑call rotation for incidents requiring escalation outside normal shift hours.

Duties and Responsibilities

• Investigate escalated alerts and incidents through log analysis, malware analysis, and digital forensics, determining scope, root cause, and impact.
• Support execution of containment and eradication actions. Support recovery of affected systems to a known-good, hardened baseline.
• Document incident timelines and findings, create and track POA&M entries to closure and contribute to after‑action reviews that feed back into detection content and playbooks.
• Review and remediate findings.
• Provide technical mentorship to Tier 1 Analysts and serve as a secondary escalation point during major incidents or surge conditions.
• Manage personnel workload and daily performance management issues.

Required Education and Experience

Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field preferred, or equivalent experience; three to five years of hands‑on incident response, digital forensics, or security operations experience.

Required Certifications

DoD 8570/8140 IAT Level III or CSSP Incident Responder certification (e.g., GCIH, GCFA, or CySA+) required; working knowledge of endpoint detection and response (EDR) tooling, packet analysis, and at least one scripting language (e.g., Python, PowerShell, or Bash) preferred.

Salary Range

$130k - $158k Depending on Experience and Shift

All employment opportunities are made without regard to age, race, creed, color, religion, sex national origin, ancestry, disability status, veteran status, sexual orientation, gender identity or expression, genetic information, marital status or any other basis protected by law.