Intrusions Management Chief

MANTECH; Linthicum (MD); On-site; USD 150,000 - 210,000; Full time

Job summary

MANTECH in Linthicum, MD seeks a motivated Intrusions Management Chief to lead DFIR activities, manage intrusion investigations, and brief leadership. This senior role interfaces with Government customers and provides technical oversight for intrusion analysis and incident response teams.

Ideal candidates hold active DFIR certifications, 7+ years in DFIR, 3+ years in leadership, and strong skills in threat intelligence, memory analysis, and network intrusion analysis.

Qualifications

• Active DFIR certifications (e.g., GCFA, GCIH, DFE) or equivalent.
• 7+ years hands-on DFIR experience.
• 5+ years focused on network intrusion analysis and malware forensics.
• 3+ years in leadership/supervisory roles directing intrusion investigations.

Responsibilities

• Lead DFIR activities and provide technical oversight to intrusion analysis and incident response personnel.
• Manage intrusion investigations and incident responders to ensure quality and timeliness.
• Analyze APT activity and correlate findings across host forensics, network logs, and threat intel.
• Brief leadership on investigation progress, findings, and operational metrics.
• Serve as primary technical contact for Government customers on intrusion tasks.
• Proactively alert Government stakeholders to potential technical or resource issues.

Skills

DFIR leadership

Network intrusion analysis

Memory analysis

Threat intelligence integration

Executive briefing

Supervisory experience

Job description

MANTECH seeks a motivated, career and customer-oriented Intrusions Management Chief to join our team in Linthicum, MD.
The Intrusions Management Chief serves as the lead for all Digital Forensics and Incident Response (DFIR) activities, providing direct management and technical oversight of intrusion analysis and incident response personnel. In this role, you will lead complex intrusion investigations, manage incident responders, brief technical findings to leadership, and act as the primary technical point of contact for the Government.

Responsibilities Include But Are Not Limited To

• Lead all Digital Forensics and Incident Response (DFIR) activities, providing direct management and technical oversight to intrusion analysis and incident response personnel.
• Lead intrusion investigations and manage incident responders to ensure high-quality and efficient team performance.
• Analyze advanced persistent threat (APT) activity and correlate findings across multiple data sources, including host forensics, network logs, and threat intelligence.
• Brief technical findings, investigation progress, and operational metrics directly to leadership.
• Act as the primary technical point of contact for the Government regarding all intrusion analysis and incident response tasks
• Proactively alert the Government to potential technical, programmatic, or resource limitation issues.

Minimum Qualifications

• Possession of at least one active certification: DC3 Cyber Training Academy Digital Forensic Examiner (DFE), GIAC Certified Forensic Analyst (GCFA), GIAC Certified Incident Handler (GCIH), or an equivalent certification approved by the COR.
• A minimum of seven (7) years of hands-on experience in Digital Forensics and Incident Response (DFIR).
• A minimum of five (5) years of experience focused specifically on network intrusion analysis, malware forensics, and memory analysis.
• A minimum of three (3) years of experience within the last five years in a leadership or supervisory role, responsible for leading intrusion investigations, managing incident responders, and briefing technical findings to leadership.
• Demonstrated experience within the last three years analyzing advanced persistent threat (APT) activity and correlating findings from multiple data sources.

Preferred Qualifications

• Extensive experience serving as a primary technical point of contact for Government customers on complex cyber incident response tasks.
• Strong track record of proactively identifying technical and resource limitations and recommending operational solutions.
• Advanced knowledge of threat intelligence integration, host forensics, and enterprise network log analysis.
• Exceptional communication skills with demonstrated ability to deliver executive-level technical briefings.

Clearance Requirements

• Must be TS/SCI clearance eligible.

Physical Requirements

• Must be able to remain in a stationary position 50% of the time. Needs to occasionally move about inside the office to access file cabinets, office machinery, etc.
• Frequently communicates with co-workers, management, and customers, which may involve delivering presentations. Must be able to exchange accurate information in these situations.