Senior Incident Response Lead - Hybrid/Remote

ECS Corporate Services; Washington (District of Columbia); Hybrid; USD 140,000 - 150,000; Full time

Job summary

Everforth ECS seeks a senior Incident Response Lead to join our advanced security operations team in Washington, DC, with optional remote work. You will own end-to-end incident response, coordinate containment, remediation, and communications, and elevate the organization’s defenses after every event.

The ideal candidate has 6+ years in security operations, deep knowledge of kill chains and ATT&CK frameworks, and proven experience leading Tier 3 incidents, developing playbooks, and driving

Qualifications

• 6+ years of progressive security operations and incident response experience.
• Experience leading incident response efforts at an enterprise level.
• Strong understanding of cyber threat frameworks and detection engineering.

Responsibilities

• Lead incident response efforts end-to-end: containment, remediation, and post-incident reporting.
• Develop and document incident response playbooks and runbooks.
• Hunt for threats, develop detection mechanisms, and strengthen security operations.
• Coordinate with cross-functional teams and communicate risk to leadership.

Skills

Incident response leadership

Cyber Kill Chain

MITRE ATT&CK

Threat hunting

Detection engineering

Malware triage

Network analysis

Log analysis

Windows/Linux/macOS security

Cloud security (AWS/Azure/GCP)

Automation scripting

Tools

SIEM platforms

Vulnerability scanners

Malware analyzers

IDS/IPS

EDR tools

Job description

Everforth ECS seeks a senior Incident Response Lead to join our advanced security operations team in Washington, DC, with optional remote work. You will own end-to-end incident response, coordinate containment, remediation, and communications, and elevate the organization’s defenses after every event.

The ideal candidate has 6+ years in security operations, deep knowledge of kill chains and ATT&CK frameworks, and proven experience leading Tier 3 incidents, developing playbooks, and driving