Incident Response Engineer - TS/SCI

Dunhill Solutions; Arlington (VA); Hybrid; USD 125,000 - 142,000; Full time

Job summary

Dunhill Solutions seeks an Incident Response Engineer Journeyman in Arlington, VA. The role focuses on detecting, investigating, and remediating security incidents in a highly regulated environment.

You will lead triage, coordinate containment, and contribute to playbooks, tooling, and reports to drive security improvements. Requires TS/SCI and U.S. citizenship.

Qualifications

• Bachelor’s degree in Cybersecurity, IT, CS or related field, or equivalent experience.
• Typically 5--7 years of security operations and incident response in regulated environments.
• Demonstrated triage of alerts, investigations, and containment support.
• Hands-on experience with SIEM and endpoint/network security tools.

Responsibilities

• Detect, investigate, and remediate security incidents affecting mission-critical systems.
• Lead or support containment and recovery efforts with owners and ops teams.
• Conduct host and network forensics, log and malware analysis to determine root cause.
• Maintain incident response runbooks and SOPs aligned to policies and frameworks.
• Participate in proactive threat hunting using telemetry and threat intel.
• Tune SIEM rules and tooling to improve detection and visibility.
• Produce incident reports, metrics, and post-incident reviews with recommendations.
• Collaborate on tabletop exercises and incident simulations.

Skills

Incident response

SIEM

Forensics

Threat hunting

Log analysis

Malware analysis

Regulatory compliance

Education

Bachelor’s degree in Cybersecurity/IT/CS or equivalent experience

Tools

Splunk

Elastic

QRadar

Job description

Incident Response Engineer-Journeyman

Intermittent Telework: Arlington, VA

TS/SCI Required

Pay Range: $125K - $142K

Job Description

The Incident Response Engineer Journeyman is a mid-level cybersecurity professional responsible for detecting, investigating, and remediating security incidents affecting mission-critical systems in a highly regulated government environment. This role analyzes security alerts, leads triage activities, and coordinates containment and recovery actions with operations, IT, and mission stakeholders. The engineer also contributes to threat hunting, maintains incident response playbooks and tooling, and produces clear reports and metrics to drive continuous improvement of security operations.

Key Responsibilities

• Perform initial detection, triage, and validation of security events from SIEM, endpoint, network, and cloud security tools to distinguish true incidents from false positives and prioritize response.
• Lead or support containment, eradication, and recovery efforts for cybersecurity incidents, coordinating with system owners and operations teams to minimize impact on mission-critical systems.
• Conduct host and network forensics, log analysis, and malware analysis to determine root cause, attack path, and data exposure, preserving evidence as needed.
• Maintain and enhance incident response runbooks, playbooks, and standard operating procedures that align with organizational policies, regulatory frameworks, and evolving threat landscapes.
• Participate in proactive threat hunting using security telemetry, threat intelligence, and behavioral analytics to identify stealthy or emerging threats in enterprise networks.
• Configure, tune, and maintain incident response tooling and SIEM rules to improve detection fidelity, reduce noise, and enhance visibility across regulated environments.
• Produce clear incident reports, metrics, and post-incident reviews documenting timeline, impact, corrective actions, and recommendations for control improvements.
• Collaborate with security training and awareness functions to support tabletop exercises, incident simulations, and communications that reinforce response readiness.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field, or equivalent relevant experience.
• Typically 5--7 years of experience in security operations and incident response with hands-on exposure to forensics and SIEM in government or similarly regulated environments.
• Demonstrated experience triaging security alerts, conducting incident investigations, and supporting containment and recovery activities.
• Hands-on experience with SIEM platforms and endpoint or network security tools used for incident detection and response.
• Proven ability to perform log analysis, basic malware analysis, and evidence preservation to support reporting and potential regulatory needs.
• Active TS/SCI security clearance
• U.S. citizenship, as required to support a federal IT environment.

Preferred Qualifications

• Experience with leading SIEM and incident response tools such as Splunk, Elastic, QRadar, or similar platforms.
• Industry certifications such as GCIA, GCFA, GCIH, or equivalent incident response/forensics credentials.
• Experience handling data spills or incidents involving sensitive or classified information under formal response frameworks.
• Background participating in threat hunting operations and developing or refining incident response playbooks.