Incident Responder - Tier 2

Evans & Chambers; Fort Meade (MD); On-site; USD 115,000 - 147,000; Full time

Job summary

Evans & Chambers is seeking a Tier 2 Incident Responder to join our defense-focused team. The role requires applying the NIST incident response lifecycle to investigate, contain, and remediate security incidents escalated from Tier 1 at Fort Meade.

The ideal candidate has TS/SCI with CI Poly, a 3–5 year track record in incident response or digital forensics, and DoD 8570/8140 IAT Level III or CSSP certification.

Qualifications

• Bachelor's degree in CS/IT/Cybersecurity or equivalent experience.
• 3–5 years hands-on incident response, digital forensics, or security operations.
• DoD 8570/8140 IAT Level III or CSSP Incident Responder certification required.

Responsibilities

• Investigate escalated alerts and incidents through logs, malware analysis, and forensics.
• Containment, eradication, and recover to known-good baseline.
• Mentor Tier 1 analysts and assist during major incidents.

Skills

Incident response

Digital forensics

Security operations

Log analysis

Malware analysis

Scripting (Python/PowerShell/Bash)

Education

Bachelor's degree in CS/IT/Cybersecurity

Tools

EDR tooling

Packet analysis

Forensics tooling

Job description

Evans & Chambers partners with the US national defense community to create fully integrated, resilient, and innovative digital solutions that enable them to make smart decisions in real-time. We work with our customers on everything from conquering their data to improving and safeguarding IT infrastructure. Our ultimate goal? To enhance our nation's ability to identify, address, and act – no matter what challenges arise.

Position Summary

The Tier 2 Incident Responder performs in-depth investigation, containment, and remediation of security incidents escalated from Tier 1, applying the NIST SP 800-61 incident response life cycle and mentors Tier 1 analysts on investigative technique.

Clearance: TS/SCI with CI Poly
Location: Ft. Meade, MD (Onsite)

Work Schedule and Conditions

Primary shift assignment within the 24/7/365 coverage model.

Duties and Responsibilities

• Investigate escalated alerts and incidents through log analysis, malware analysis, and digital forensics, determining scope, root cause, and impact.
• Support execution of containment and eradication actions. Support recovery of affected systems to a known-good, hardened baseline.
• Document incident timelines and findings, create and track POA&M entries to closure and contribute to after-action reviews that feed back into detection content and playbooks.
• Review and remediate findings.
• Provide technical mentorship to Tier 1 Analysts and serve as a secondary escalation point during major incidents or surge conditions.

Required Education and Experience

Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field preferred, or equivalent experience; three to five years of hands‑on incident response, digital forensics, or security operations experience.

Required Certifications

DoD 8570/8140 IAT Level III or CSSP Incident Responder certification (e.g., GCIH, GCFA, or CySA+) required; working knowledge of endpoint detection and response (EDR) tooling, packet analysis, and at least one scripting language (e.g., Python, PowerShell, or Bash) preferred.

Salary Range

$115-$147k based on experience and shift

All employment opportunities are made without regard to age, race, creed, color, religion, sex national origin, ancestry, disability status, veteran status, sexual orientation, gender identity or expression, genetic information, marital status or any other basis protected by law.