Senior Incident Response Lead — Remote (Govt Program)

tetraddigitalintegrityllc; Arlington (VA); Hybrid; USD 120,000 - 135,000; Full time

Job summary

Tetrad Digital Integrity (TDI) seeks a Senior Incident Response Analyst to join our SOC and help monitor, detect, investigate, and respond to cyber threats in a large-scale government program. The role requires onsite 2 days weekly for Arlington, VA residents, while others may work fully remotely.

You will lead IR activities, analyze events, and develop IOCs and playbooks, leveraging MITRE ATT&CK. Strong scripting and Windows/Linux expertise are essential for automation and containment.

Qualifications

• Bachelor's degree in CS, Engineering, IT, Cybersecurity, or related field.
• 12–15 years of relevant incident response experience.
• Hands-on incident detection/response, malware analysis, or computer forensics.
• Expertise with Windows and Linux OS, enterprise networking, and security infrastructure.
• Experience investigating incidents, root-cause analysis, attacker TTPs; MITRE ATT&CK and Cyber Kill Chain.
• Proficiency in Python, PowerShell, Bash for automation.

Responsibilities

• Lead and coordinate incident response across the full lifecycle.
• Analyze events, logs, network traffic, and telemetry to determine scope and impact.
• Identify TTPs and develop IOCs to improve detection.
• Develop and maintain incident response playbooks and SOPs.
• Configure and optimize SIEM, EDR, IDS/IPS and monitoring tools.
• Create detection content, rules, and automation scripts.
• Document investigations and produce incident reports and after-action documentation.
• Establish and track SOC KPIs for continuous improvement.

Skills

Incident response

SOC

Python

PowerShell

Bash

MITRE ATT&CK

Windows

Linux

Networking

Scripting

Education

Bachelor's degree in CS/Engineering/IT/Cybersecurity

Tools

SIEM

EDR

IDS/IPS

Firewalls

Proxies

VPNs

Load balancers

Job description

Tetrad Digital Integrity (TDI) seeks a Senior Incident Response Analyst to join our SOC and help monitor, detect, investigate, and respond to cyber threats in a large-scale government program. The role requires onsite 2 days weekly for Arlington, VA residents, while others may work fully remotely.

You will lead IR activities, analyze events, and develop IOCs and playbooks, leveraging MITRE ATT&CK. Strong scripting and Windows/Linux expertise are essential for automation and containment.