Senior Incident Response Lead

Leidos; Washington (District of Columbia); On-site; USD 108,000 - 195,000; Full time

Benefits offered by this job

Health and Wellness programs

Competitive compensation

Retirement benefits

Job summary

Leidos in Washington, DC is seeking an Incident Response Lead to join its DHS SOC support team. You will oversee incident response activities across the lifecycle, provide technical leadership, and collaborate with government and contractor teams to monitor, detect, and respond to cyber threats.

The role requires a TS/SCI clearance, US citizenship, and 8–12 years in technical roles, including 4+ years of people management and 5+ years in intrusion detection and incident handling.

Qualifications

• 8–12 years of experience in a technical discipline.
• 4+ years of supervising and/or managing teams.
• 5+ years of intrusion detection and/or incident handling experience.
• Must hold active TS/SCI security clearance and US citizenship.

Responsibilities

• In-depth knowledge of incident response lifecycle phases.
• Expertise in Windows and Linux operations and artifacts.
• Understanding of enterprise network architectures, routing, switching, and security devices.
• Identify suspicious activity and determine root cause and scope of incidents.
• Lead tool and framework improvements for SOC operations.
• Promote best practices in incident response and SOC operations.
• Drive automation and process efficiencies.
• Familiarity with Cyber Kill Chain and ATT&CK frameworks.
• Mentor analysts to deliver high-quality analyses.
• Build trust with customers and stakeholders.

Skills

Incident response leadership

Windows & Linux operations

Network architectures & security

Threat analysis

Mentoring and guidance

Customer stakeholder management

Cyber Kill Chain/ATT&CK familiarity

Clear communication

Education

Bachelor's Degree

Tools

SIEM platforms

Job description

Leidos in Washington, DC is seeking an Incident Response Lead to join its DHS SOC support team. You will oversee incident response activities across the lifecycle, provide technical leadership, and collaborate with government and contractor teams to monitor, detect, and respond to cyber threats.

The role requires a TS/SCI clearance, US citizenship, and 8–12 years in technical roles, including 4+ years of people management and 5+ years in intrusion detection and incident handling.