INCIDENT RESPONSE LEAD

Zermount, Inc.; Arlington (VA); Hybrid; USD 120.000 - 160.000; Vollzeit

Zusammenfassung

Zermount, Inc. is seeking an experienced Incident Response Lead to supervise a SOC shift, coordinate real-time monitoring and investigations, and deliver defensible conclusions across on-premises and cloud environments.

You will mentor junior staff, document evidence and timelines, and drive containment and remediation actions within a hybrid federal customer environment. The role requires 7+ years in cybersecurity and strong incident-analysis capability, plus experience with SIEM, endpoint

Qualifikationen

• Seven or more years of cybersecurity experience with hands-on SOC/incidents work.
• Demonstrated ability to solve difficult or unclear problems through deep analysis and collaboration.
• Hands-on experience with enterprise SIEM, endpoint security, network monitoring, and case-management technologies.

Aufgaben

• Lead an assigned SOC shift and coordinate monitoring, triage, incident intake, investigation, escalation, and response activities.
• Monitor alerts, logs, events, and security data for anomalous or malicious activity and determine severity, impact, and escalation.
• Receive, review, document, and coordinate suspicious-activity and incident reports from internal/external sources.
• Perform incident analysis to identify activity, affected systems, indicators of compromise, event timelines, likely cause, severity, scope, and impact.
• Correlate data to develop defensible findings and support containment, eradication, and recovery actions.
• Document evidence, confidence levels, and recommended remediation actions.
• Mentor junior analysts, review work products, and contribute to playbooks.
• Participate in exercises and surge operations.

Kenntnisse

Cybersecurity

SOC experience

Incident response

SIEM

Endpoint security

Network monitoring

Documentation

Shift work

Ausbildung

Bachelor’s degree in cybersecurity, computer science, information systems or related field

Security certifications (GCIH, GCIA, GCFA, CySA+, CEH)

Tools

Case management tools

Jobbeschreibung

Incident Response Lead

Position Overview

The Incident Response Shift Lead is a senior analyst responsible for real-time monitoring, triage, incident intake, investigation, coordinated response, shift execution, and analyst mentoring. The role leads an assigned shift, manages urgent technical work, maintains clear operational handoffs, and develops defensible conclusions from incomplete or ambiguous evidence across on-premises and cloud environments.

Duties & Responsibilities

• Lead an assigned SOC shift and coordinate monitoring, triage, incident intake, investigation, escalation, and response activities.
• Monitor alerts, logs, events, and security data for anomalous or malicious activity and determine severity, impact, and required escalation.
• Receive, review, document, and coordinate suspicious-activity and incident reports from authorized internal and external sources.
• Perform incident analysis to identify relevant activity, affected systems, indicators of compromise, event timelines, likely cause, severity, scope, and operational impact.
• Correlate alerts, logs, endpoint data, network data, cloud telemetry, threat intelligence, artifacts, and prior cases to develop defensible findings.
• Document evidence, confidence levels, analytical judgments, unresolved questions, and recommended response or remediation actions.
• Recommend and support containment, eradication, recovery, and post-incident improvement activities with system and service owners.
• Create, update, and maintain accurate incident records and support closure only after required remediation, coordination, and documentation are complete.
• Conduct disciplined shift handoffs covering open incidents, pending notifications, degraded tools or feeds, approvals, risks, and deadline-sensitive actions.
• Operate and troubleshoot assigned SOC tools and escalation platform or engineering problems through the designated technical lead.
• Mentor junior analysts, review work products, reinforce procedures, and contribute to lessons learned and playbook improvements.
• Participate in exercises, continuity activities, and surge operations as assigned.

Qualifications

Minimum Requirements:

• Seven or more years of cybersecurity experience, including substantial hands-on SOC, incident-response, cyber-defense, or threat-analysis work.
• Demonstrated ability to solve difficult or unclear technical problems through deep analysis and collaboration with internal experts.
• Hands-on experience with enterprise SIEM, endpoint security, network-security monitoring, and case-management technologies.
• Strong incident documentation and briefing skills, including the ability to distinguish facts, interpretations, and unresolved questions.
• Ability to work an assigned 24x7 shift and support after-hours coverage as required.

Preferred Qualifications:

• Five or more years in a 24x7 SOC or incident response center, including experience as a shift lead or senior analyst.
• Experience investigating incidents across on-premises, AWS, Azure, Microsoft 365, identity, endpoint, and network environments.
• GCIH, GCIA, GCFA, CySA+, CEH, Security+, or comparable role-aligned cybersecurity certifications preferred.
• Working knowledge of widely used incident-response and federal incident-notification guidance.
• Demonstrated ability to communicate clearly with technical and customer leads during high-priority events.

What Success Looks Like

• Alerts and incident reports receive timely, consistent, evidence-based triage and escalation.
• Investigations produce clear timelines, scope, impact, findings, and recommended actions.
• Shift handoffs preserve continuity and leave no ambiguity about ownership, status, and next action.
• Junior analysts improve through direct coaching, quality review, and practical operational guidance.

Education and Certifications:

• Minimum: Bachelor's degree in cybersecurity, computer science, information systems, engineering, or a related field; additional relevant experience may be considered in lieu of a degree.

Clearance Level:

• Secret clearance preferred but not required.

Work Location

• Hybrid federal customer environment. Regular onsite presence and periodic travel between supported operating locations may be required.

Hours of Operation

• Assigned 24x7 SOC shift, which may include days, nights, weekends, and holidays. Participation in on-call and non-regular-duty coverage may be required.
• Ability to pass a minimum background investigation.