Remote Incident Response & Automation Lead

S2i2-Inc; Washington (District of Columbia); Remote; USD 130,000 - 160,000; Full time

Benefits offered by this job

Certifications support

Leadership access

Regular updates

Client networking

Team-building events

Veteran support

Job summary

S2i2 is seeking an Incident Detection and Response Manager to lead incident response for a high‑risk environment. The role owns the Incident Response as Code workstream and coordinates with government and client security teams to meet strict SLAs and reporting timelines.

You will design and automate playbooks, integrate with Splunk and AWS, and mentor a small IR team. The position is primarily remote with occasional on‑site meetings in Washington, DC.

Qualifications

• Ten+ years in cybersecurity with leadership in incident response for regulated environments.
• Hands-on automation of incident response using Python and SOAR tools.
• Experience with Splunk and AWS; able to link incident triggers to governance.
• U.S. citizenship and ability to obtain public trust.

Responsibilities

• Serve as named Key Personnel lead for incident detection and response.
• Own the incident response plan, playbooks, escalation and comms.
• Meet SLAs for P1, breach reporting, restoration and RCA delivery.
• Design and maintain IR as Code playbooks in GitLab.
• Represent the program at daily SOC meetings and coordinate with stakeholders.
• Lead a small team of IR analysts.

Skills

Incident response leadership

Automation with Python

SIEM & SOAR

NIST SP 800-61

FISMA / FedRAMP

AWS

PII handling at scale

Tools

Splunk

GitLab CI

AWS

Job description

S2i2 is seeking an Incident Detection and Response Manager to lead incident response for a high‑risk environment. The role owns the Incident Response as Code workstream and coordinates with government and client security teams to meet strict SLAs and reporting timelines.

You will design and automate playbooks, integrate with Splunk and AWS, and mentor a small IR team. The position is primarily remote with occasional on‑site meetings in Washington, DC.