Senior Incident Response Lead - Remote

ECS; Washington (District of Columbia); Hybrid; USD 140,000 - 150,000; Full time

Job summary

Everforth ECS is seeking a Senior Incident Response Lead to join our advanced security operations team in Washington, DC, with an option for remote work. This Tier 3 role is the last line of defense and requires leading incident response efforts end-to-end, including containment, remediation, and communication of timelines to leadership.

The position operates within our secure enterprise environment, focusing on hunting threats, developing detections, and refining processes to elevate team

Qualifications

• Lead incident response efforts end-to-end including containment and remediation.
• Develop timelines and post-incident reports for executive review.
• Investigate security incidents and communicate findings to technical teams and leadership.
• Develop and document IR playbooks, runbooks, and SOPs.
• Experience with structured threat hunting and detection development.

Responsibilities

• Lead incident response efforts end-to-end: containment, remediation, timelines, and reporting.
• Coordinate with security operations and other teams to strengthen defenses after incidents.
• Develop and refine detection logic across multiple logs and data sources.
• Mentor junior team members and serve as escalation point for SR security staff.

Skills

Incident response leadership

Threat hunting

Detection engineering

Malware analysis

Security operations

Scripting & automation

Communication to leadership

Cross-team collaboration

Education

Bachelor's degree in Computer Science, Cybersecurity, IT, or related field

Tools

SIEM platforms

EDR tools

Cloud platforms (AWS/Azure/GCP)

Job description

Everforth ECS is seeking a Senior Incident Response Lead to join our advanced security operations team in Washington, DC, with an option for remote work. This Tier 3 role is the last line of defense and requires leading incident response efforts end-to-end, including containment, remediation, and communication of timelines to leadership.

The position operates within our secure enterprise environment, focusing on hunting threats, developing detections, and refining processes to elevate team