Senior Incident Response Lead (TS/SCI)

Leidos; Ashburn (VA); On-site; USD 110,000 - 195,000; Full time

Job summary

Leidos seeks an Incident Response Lead to join our cyber security team supporting the DHS SOC program. You will oversee incident handling, detection, and analysis across a 24x7 environment, guiding a seasoned team and coordinating with DHS components.

Preferred qualifications include a CISSP and SANS GCIH/GCIA, active TS/SCI clearance, and 8–12 years in technical roles. A Bachelor's degree and supervisory experience are required.

Qualifications

• Bachelor's Degree and 8-12 years of technical experience.
• 4+ years of supervising and/or managing teams
• 5+ years of intrusion detection and/or incident handling experience
• CISSP and SANS GCIH or GCIA required upon start
• Advanced knowledge in planning, directing, and managing Computer Incident Response Team (CIRT) and/or Security Operations Center (SOC) operations for a large and complex Enterprise
• Significant experience supervising and leading employees of various labor categories and technical skill levels in efforts similar in size and scope to a mature Security Operation
• Mature understanding of industry accepted standards for incident response actions and best practices related to SOC operations
• Strong written and verbal communication skills, and the ability to create technical reports based on analytical findings
• Strong analytical and troubleshooting skills
• Must be a US Citizen
• Must hold active TS/SCI security clearance to be considered

Responsibilities

• In-depth knowledge of each phase of the Incident Response life cycle
• Expertise in Operating Systems (Windows/Linux) operations and artifacts
• Understanding of Enterprise Network Architectures to include routing/switching, common protocols (DHCP, DNS, HTTP, etc), and devices (Firewalls, Proxies, Load Balancers, VPN, etc)
• Ability to recognize suspicious activity/events, common attacker TTPs, perform logical analysis and research to determine root cause and scope of Incidents
• Drive implementation and improvement of new tools, capabilities, frameworks, and methodologies
• Instill and reinforce industry best practices in the domains of incident response, cybersecurity analysis, case and knowledge management, and SOC operations
• Promote and drive implementation of automation and process efficiencies
• Familiarity with Cyber Kill Chain and ATT&CK Framework and how to leverage in Security Operations
• Provide guidance and mentorship to improve analyst skill sets and ensure delivery of high quality analysis and work products
• Establish trust and business relationships with customer and other relevant stakeholders

Skills

Incident response life cycle

Operating Systems Windows/Linux

Network architectures

Threat detection & TTPs

Tools/frameworks/methodologies

SOC operations best practices

Automation & process improvement

Cyber Kill Chain / ATT&CK

Mentorship & guidance

Stakeholder relations

Education

Bachelor's degree in a technical field

Tools

None

Job description

Leidos seeks an Incident Response Lead to join our cyber security team supporting the DHS SOC program. You will oversee incident handling, detection, and analysis across a 24x7 environment, guiding a seasoned team and coordinating with DHS components.

Preferred qualifications include a CISSP and SANS GCIH/GCIA, active TS/SCI clearance, and 8–12 years in technical roles. A Bachelor's degree and supervisory experience are required.