INCIDENT RESPONSE LEAD

Zermount, Inc.; Arlington (VA); Hybrid; USD 120,000 - 170,000; Full time

Job summary

Zermount, Inc. seeks an Incident Response Lead to manage real-time SOC operations, triage, and coordinated response across on‑premises and cloud environments.

You will mentor analysts, document findings with confidence levels, and ensure rigorous handoffs, playbooks, and post-incident improvements. The role requires a 24x7 shift and hybrid federal work environment.

Qualifications

• 7+ years of cybersecurity experience including hands-on SOC and incident response.
• Experience with enterprise SIEM, endpoint security, and case-management tools.
• Ability to work a 24x7 shift and support after-hours coverage.
• Strong incident documentation and briefing skills.

Responsibilities

• Lead an assigned SOC shift and coordinate monitoring, triage, incident intake, investigation, escalation, and response.
• Monitor alerts and determine severity, impact, and escalation requirements.
• Document evidence, confidence levels, and recommended actions.
• Mentor junior analysts and conduct disciplined shift handoffs.
• Participate in exercises and surge operations as assigned.

Education

Bachelor's degree in cybersecurity or related field

Tools

Enterprise SIEM

Endpoint security

Network security monitoring

Case management systems

Job description

Incident Response Lead

Position Overview

The Incident Response Shift Lead is a senior analyst responsible for real-time monitoring, triage, incident intake, investigation, coordinated response, shift execution, and analyst mentoring. The role leads an assigned shift, manages urgent technical work, maintains clear operational handoffs, and develops defensible conclusions from incomplete or ambiguous evidence across on-premises and cloud environments.

Duties & Responsibilities

• Lead an assigned SOC shift and coordinate monitoring, triage, incident intake, investigation, escalation, and response activities.
• Monitor alerts, logs, events, and security data for anomalous or malicious activity and determine severity, impact, and required escalation.
• Receive, review, document, and coordinate suspicious-activity and incident reports from authorized internal and external sources.
• Perform incident analysis to identify relevant activity, affected systems, indicators of compromise, event timelines, likely cause, severity, scope, and operational impact.
• Correlate alerts, logs, endpoint data, network data, cloud telemetry, threat intelligence, artifacts, and prior cases to develop defensible findings.
• Document evidence, confidence levels, analytical judgments, unresolved questions, and recommended response or remediation actions.
• Recommend and support containment, eradication, recovery, and post-incident improvement activities with system and service owners.
• Create, update, and maintain accurate incident records and support closure only after required remediation, coordination, and documentation are complete.
• Conduct disciplined shift handoffs covering open incidents, pending notifications, degraded tools or feeds, approvals, risks, and deadline-sensitive actions.
• Operate and troubleshoot assigned SOC tools and **escalate** platform or engineering problems through the designated technical lead.
• Mentor junior analysts, review work products, reinforce procedures, and contribute to lessons learned and playbook improvements.
• Participate in exercises, continuity activities, and surge operations as assigned.

Qualifications

Minimum Requirements

• Seven or more years of cybersecurity experience, including substantial hands-on SOC, incident-response, cyber-defense, or threat-analysis work.
• Demonstrated ability to solve difficult or unclear technical problems through deep analysis and collaboration with internal experts.
• Hands-on experience with enterprise SIEM, endpoint security, network-security monitoring, and case-management technologies.
• Strong incident documentation and briefing skills, including the ability to distinguish facts, interpretations, and unresolved questions.
• Ability to work an assigned 24x7 shift and support after-hours coverage as required.

Preferred Qualifications

• Five or more years in a 24x7 SOC or incident response center, including experience as a shift lead or senior analyst.
• Experience investigating incidents across on-premises, AWS, Azure, Microsoft 365, identity, endpoint, and network environments.
• GCIH, GCIA, GCFA, CySA+, CEH, Security+, or comparable role-aligned cybersecurity certifications preferred.
• Working knowledge of widely used incident-response and federal incident-notification guidance.
• Demonstrated ability to communicate clearly with technical and customer leads during high-priority events.

What Success Looks Like

• Alerts and incident reports receive timely, consistent, evidence-based triage and escalation.
• Investigations produce clear timelines, scope, impact, findings, and recommended actions.
• Shift handoffs preserve continuity and leave no ambiguity about ownership, status, or next action.
• Junior analysts improve through direct coaching, quality review, and practical operational guidance.

Education and Certifications

• Minimum: Bachelor's degree in cybersecurity, computer science, information systems, engineering, or a related field; additional relevant experience may be considered in lieu of a degree.

Clearance Level

• Secret clearance preferred but not required.

Work Location

• Hybrid federal customer environment. Regular onsite presence and periodic travel between supported operating locations may be required.

Hours of Operation

• Assigned 24x7 SOC shift, which may include days, nights, weekends, and holidays. Participation in on-call and non-regular-duty coverage may be required.

Additional Requirements

• Ability to pass a minimum background investigation.