Senior SOC Incident Commander

ECS Corporate Services; Fairfax (VA); Teletrabalho; USD 140 000 - 160 000; Tempo integral

Resumo da oferta

Everforth ECS is seeking an Incident Detection/Response Manager to lead our 24x7 SOC supporting a major federal civilian agency. You will direct Tier I–III incident response, coordinate containment and recovery, and drive continuous improvement in detection capabilities.

The role requires US citizenship, 8+ years IT with 4+ years in incident response, and active Public Trust 6c or ability to obtain one. Proximity to NCR is preferred for on-site coordination.

Qualificações

• U.S. Citizenship required.
• 8+ years of IT experience with 4+ years in incident response/SOC operations.
• Active Public Trust 6c clearance or ability to obtain one.
• Experience with SIEM, SOAR, EDR, CDM, and malware analysis tools.

Responsabilidades

• Manage SOC daily activities, shift schedules, and ensure SOPs/Playbooks/CONOPS are current.
• Oversee Tier I–III incident response across a large federal enterprise, ensuring quality responses.
• Act as incident commander during active incidents, coordinating with SOC, IT operations, and stakeholders.
• Lead post-incident reviews and root-cause analysis for lessons learned.
• Ensure compliance with NIST SP 800-61 and federal incident response procedures.
• Maintain SIEM dashboards and ensure timely triage and resolution of alerts.
• Maintain 24/7 SOC coverage schedule and contact trees for partner organizations and CSPs.
• Apply MITRE ATT&CK to map attacker TTPs during investigations and response.
• Collaborate with threat hunting, CTI, engineering, and architecture teams.

Conhecimentos

Incident response

SOC operations

Threat hunting

Communication

Security incident management

Ferramentas

SIEM

SOAR

EDR

CDM

malware analysis tools

Descrição da oferta de emprego

Everforth ECS is seeking an Incident Detection/Response Manager to lead our 24x7 SOC supporting a major federal civilian agency. You will direct Tier I–III incident response, coordinate containment and recovery, and drive continuous improvement in detection capabilities.

The role requires US citizenship, 8+ years IT with 4+ years in incident response, and active Public Trust 6c or ability to obtain one. Proximity to NCR is preferred for on-site coordination.