Remote Incident Detection & Response Lead (IR Automation)

S2i2 Inc; Washington (District of Columbia); Remote; USD 130,000 - 160,000; Full time

Benefits offered by this job

Certifications support

Accessible leadership

Team-building events

Client networking

Veteran support

Job summary

S2i2 is seeking an Incident Detection and Response Manager (Lead) to head incident response for a high-security environment, with a strong focus on automation and governance. This role requires US citizenship and the ability to obtain a Public Trust clearance, and offers a flexible, primarily remote work model with periodic headquarters meetings in Washington, DC.

The position combines incident response leadership with engineering efforts to codify playbooks, automate detection, containment and

Qualifications

• Ten+ years in cybersecurity with 5+ years leading incident response for a federal agency or regulated enterprise.
• Demonstrated incident command experience covering containment, eradication, recovery, RCA and executive communication.
• Hands-on automation of incident response using SOAR, scripted playbooks (Python), API integration with SIEM and CI/CD pipelines.
• Working knowledge of NIST SP 800-53 Rev 5, NIST SP 800-61, RMF, and FISMA reporting requirements.
• Experience with Splunk or equivalent SIEM and with AWS.
• US citizen, able to obtain Department of Education High Risk Public Trust.
• Able to document measurable outcomes: MTTD/MTTR, incidents handled, SLAs, automation coverage, audit findings.

Responsibilities

• Serve as the named Key Personnel lead for incident detection and response; substitution requires government approval.
• Own the incident response plan, playbooks, escalation paths and communications; align to NIST/SP policies.
• Meet SLAs for P1 notification, breach reporting, restoration, RCA, and deliver weekly monitoring reports.
• Design, build and maintain Incident Response as Code playbooks; version-controlled in GitLab, deployed via CI/CD.
• Integrate automation with Splunk, Tenable, Qualys; minimize manual evidence collection where feasible.
• Represent the program at daily SOC meetings; communicate incidents, health, outages to senior leadership.
• Coordinate breach response for IHE and GLBA; liaise with Privacy and Safeguards on PII/Federal Tax Information.
• Lead a small team of IR analysts; mentor on response discipline and automation practices.
• Contribute to Zero Trust gap reduction and continuous ATO from IR perspective.

Skills

Incident response leadership

Automation of IR

NIST SP 800-53 Rev 5

AWS experience

PII handling in high-security env

FISMA High / FedRAMP High experience

Public Trust readiness

Measurable outcomes documentation

Tools

GitLab CI

Jira

Confluence

CI/CD pipelines

Splunk

Tenable

Qualys

Job description

S2i2 is seeking an Incident Detection and Response Manager (Lead) to head incident response for a high-security environment, with a strong focus on automation and governance. This role requires US citizenship and the ability to obtain a Public Trust clearance, and offers a flexible, primarily remote work model with periodic headquarters meetings in Washington, DC.

The position combines incident response leadership with engineering efforts to codify playbooks, automate detection, containment and