Incident Response Lead

ECS

Washington (District of Columbia)

Hybrid

USD 140,000 - 150,000

Full time

14 days+

Get more replies from employers

Send a job-specific resume in minutes.

Job summary

Everforth ECS is seeking a Senior Incident Response Lead to join our advanced security operations team in Washington, DC, with an option for remote work. This Tier 3 role is the last line of defense and requires leading incident response efforts end-to-end, including containment, remediation, and communication of timelines to leadership.

The position operates within our secure enterprise environment, focusing on hunting threats, developing detections, and refining processes to elevate team

Qualifications

Lead incident response efforts end-to-end including containment and remediation.
Develop timelines and post-incident reports for executive review.
Investigate security incidents and communicate findings to technical teams and leadership.
Develop and document IR playbooks, runbooks, and SOPs.
Experience with structured threat hunting and detection development.

Responsibilities

Lead incident response efforts end-to-end: containment, remediation, timelines, and reporting.
Coordinate with security operations and other teams to strengthen defenses after incidents.
Develop and refine detection logic across multiple logs and data sources.
Mentor junior team members and serve as escalation point for SR security staff.

Skills

Incident response leadership

Threat hunting

Detection engineering

Malware analysis

Security operations

Scripting & automation

Communication to leadership

Cross-team collaboration

Education

Bachelor's degree in Computer Science, Cybersecurity, IT, or related field

Tools

SIEM platforms

EDR tools

Cloud platforms (AWS/Azure/GCP)

Job description

Job Description

Everforth ECS is seeking an

The role is contingent upon additional funding. We are seeking a senior-level

Everforth ECS is seeking an Incident Response Lead to work in our Washington, DC office / remote. The role is contingent upon additional funding. We are seeking a senior-level Incident Response Lead to join our advanced security operations team which is a specialized group focused on the most complex and high-priority cybersecurity challenges facing the enterprise. This is a Tier 3 position, meaning you are the last line of defense and the highest level of technical escalation within the security operations function.

Day to day, you will operate as a senior security operations specialist consisting of hunting threats, developing detection mechanisms, refining processes, and elevating the capabilities of the team around you. When an incident strikes, you step forward. You will be called upon to lead incident response efforts end to end: coordinating containment, driving remediation, communicating timelines, and ensuring the organization emerges from each event with stronger defenses than it had before.

Salary Range: $140,000 - $150,000

General Description Of Benefits

Required Skills

Incident Response & Threat Operations

Proven ability to lead incident response efforts including triage, containment, remediation, and post-incident reporting
Deep familiarity with the Cyber Kill Chain, MITRE ATT&CK, Diamond Model of Intrusion Analysis, or equivalent frameworks
Experience investigating security incidents, developing timelines, and communicating findings to both technical teams and senior leadership
Ability to perform malware triage, network analysis, and live response as part of incident handling
Experience developing and documenting incident response playbooks, runbooks, and standard operating procedures

Threat Hunting & Detection Engineering

Ability to develop, document, and execute structured hunt plans against enterprise environments
Experience creating custom detection mechanisms that correlate across multiple log sources
Proficiency in log analysis and security event detection across diverse and complex environments
Ability to translate hunt findings into actionable detections and repeatable operational processes

Security Operations

Experience with SIEM platforms, vulnerability scanners, malware analyzers, IDS/IPS systems, and EDR tools
Proficiency working across Windows, Linux, and macOS operating systems from a security operations and response perspective
Familiarity with cloud security operations across platforms such as AWS, Azure, or GCP
Ability to identify new data sources and analysis techniques to improve detection of security events
Experience with automation platforms and scripting to reduce manual, repetitive tasks

Leadership & Collaboration

Serves as the senior escalation point and subject matter expert for security operations personnel
Ability to work with staff to develop a vision and independently lead the implementation of new capabilities
Experience participating in the development of technical security standards, monitoring standards, and incident investigation procedures
Comfortable interacting with executive management to communicate risk and support enterprise-level security decisions
Able to collaborate across teams including networking, systems administration, and technology support partners

Desired Skills

Experience with behavior-based analytics and anomaly detection techniques
Cloud forensics and incident response experience in SaaS or multi-tenant environments
Familiarity with threat modeling and development of countermeasures
Scripting and automation experience in Python, PowerShell, Bash, or Perl
Experience developing or refining detection logic, exclusions, and tuning within enterprise security tooling
Quality assurance and continuous improvement experience within a security operations context
Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field, or equivalent hands-on experience
Relevant certifications such as GCIH, GCFA, GCFE, CISSP, or equivalent are strongly preferred

ECS Federal LLC is an equal opportunity employer and does not discriminate or allow discrimination on the basis any characteristic protected by law. All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, or local jurisdiction law.

Everforth ECS is the federal segment of Everforth, a $4B global organization with over 10,000 employees. Our nearly 3,500 professionals deliver advanced technology solutions in data and AI, cybersecurity, and enterprise transformation, serving defense, intelligence, and federal civilian agencies.

Our work powers mission-critical outcomes, strengthens technology partnerships, and creates meaningful opportunities for our people. We are defined by a commitment to excellence in delivery, a culture of innovation, and an environment where talent can thrive and grow.

We Value