Sr. Incident Responder

Revolutional; Washington (District of Columbia, MD); On-site; USD 130,000 - 170,000; Full time

Job summary

Revolutional is seeking a Sr. Incident Responder for a 24x7x365 SOC supporting a large federal agency. The role is onsite in New Carrollton, MD or Memphis, TN and requires US citizenship with the ability to obtain a Public Trust clearance.

The successful candidate will lead incident analysis, develop timelines, and mentor incident responders while coordinating with client IT and vendors to ensure effective containment and remediation actions.

Qualifications

• Bachelor’s degree in a related field and 7+ years of experience; three additional relevant years may substitute for the degree.
• Extensive incident analysis experience in large enterprise environments.
• Proficiency with SIEM, EDR, and network security monitoring.
• Experience with NIST SP 800-61 and MITRE ATT&CK frameworks.

Responsibilities

• Lead incident analysis from initial evidence through recommended response.
• Analyze suspected incidents to identify activity, affected systems, IOCs, timelines and impact.
• Correlate data from logs, alerts, artifacts, reports, threat intel and other sources.
• Document analytical findings, confidence levels, evidence, and recommended actions.
• Coordinate analysis with client IT, contractors, vendors, and stakeholders.
• Support federal and organizational incident reporting requirements.
• Use findings to improve monitoring, triage, escalation, and analysis procedures.

Skills

Incident analysis

SIEM

EDR

Network security monitoring

Threat intelligence

MITRE ATT&CK

NIST SP 800-61

Security certifications (GCIH/GCIA/GCF

AWS/Azure

Federal contracting

Education

Bachelor's degree in Cybersecurity/CS/IS/Engineering

Tools

SIEM tools

EDR tools

SOAR

Threat intelligence platforms

Incident reporting tools

Job description

Location: Onsite – New Carrollton, MD or Memphis, TN

Terms: Full-time

Clearance: Public Trust

Travel: 0% (onsite presence at client facilities as directed)

Position Description

We are seeking a Sr. Incident Responder to serve as task lead for incident analysis in a 24x7x365 Security Operations Center (SOC) supporting a large federal agency. This seasoned technical contributor analyzes suspected cybersecurity incidents to determine their nature, scope, severity, likely cause, affected assets, operational impact, and recommended response actions, leads the incident responders performing this work, and collaborates with internal experts on deep analyses.

The successful candidate will:

• Lead incident analysis from initial evidence through recommended response.
• Deliver clear, well-supported incident findings and timelines.
• Turn lessons learned into better monitoring, triage, and escalation.
• Guide and develop incident responders.

Responsibilities:

• Serve as task lead for incident analysis, assigning and reviewing the work of incident responders.
• Analyze suspected incidents to identify relevant activity, affected systems, indicators of compromise, timeline of events, and potential impact.
• Correlate data from logs, alerts, artifacts, reports, threat intelligence, and other approved sources.
• Document analytical findings, confidence levels, supporting evidence, and recommended response or remediation actions in Incident Analysis Reports.
• Coordinate analysis with client IT organizations, other contractors, vendors, and authorized stakeholders as directed.
• Support federal and organizational incident reporting requirements as directed.
• Use incident findings and lessons learned to improve monitoring, triage, escalation, and analysis procedures.

Required Skills and Experience

• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related field and 7+ years of relevant professional experience; three (3) years of additional relevant experience may be substituted in lieu of a degree.
• Seasoned technical individual contributor, fully proficient in applying technical principles, theories, and concepts in the field.
• Ability to develop solutions to technical problems and issues that are difficult, unclear, and require deep technical knowledge.
• Deep understanding of the principles, theories, and concepts of the technical domain, with broad understanding of related specialty areas.
• Experience performing in-depth incident analysis in large enterprise environments, including log analysis and IOC correlation.
• Expertise with SIEM, EDR, and network security monitoring tools.
• Working knowledge of NIST SP 800-61 and the MITRE ATT&CK framework.
• Experience supporting federal government contracts as a contractor, including working to contract performance standards, deliverable schedules, and government review and approval processes.
• Certifications such as GCIH, GCIA, GCFA, or CISSP.
• Experience analyzing incidents in AWS and Microsoft Azure/M365 environments.
• Experience with SOAR playbooks and automation.

Work Authorization/Clearance: Must be a U.S. Citizen and able to obtain a Public Trust clearance.