Incident Response Expert III

{
  "content_hash": "a08eda52386e12f5b749437ddf5163f42fa1a11e31bf2d662f7af69459b179ef",
  "source_hash": "a1d01755dabf7f03a0728d7ad792140d75cb948b3ffb5d8e5c2cf94c7bfb404d",
  "last_changed_at": "2026-05-29T07:08:33.097Z",
  "active_status": "active"
}

{
  "language": "en",
  "location": {
    "raw": "Arlington, VA",
    "city": "Arlington",
    "region": "VA",
    "country": "United States",
    "is_remote": false,
    "confidence": 0.9
  },
  "salary_max": null,
  "salary_min": null,
  "inferred_at": "2026-06-06T18:44:29.849Z",
  "launch_scope": {
    "reason": "english_us_canada",
    "included": true,
    "language": "en",
    "location": {
      "raw": "Arlington, VA",
      "city": "Arlington",
      "region": "VA",
      "country": "United States",
      "is_remote": false,
      "confidence": 0.9
    },
    "countries": [
      "United States"
    ]
  },
  "remote_policy": null,
  "salary_period": null,
  "workplace_type": "on_site",
  "salary_currency": null
}

{}

{
  "lists": [
    {
      "text": "Responsibilities",
      "content": "\n<li>Serves as hunt and incident response subject matter expert (SME), applying in-depth knowledge on threat actor (TA) tools, techniques, and procedures (TTPs)</li>\n<li>Distills analytic findings into executive summaries and in-depth technical reports</li>\n<li>Provide expert support, analysis, and research with only broad direction into exceptionally complex problems and processes relating to the subject matter as it relates to hunt and incident response activities</li>\n<li>Serves as technical expert on high-level incident response teams providing technical direction, interpretation, and alternatives</li>\n<li>Exercises considerable latitude in determining technical objectives of an assignment or task at hand</li>\n<li>Independently develops technical solutions to complex problems that require the regular use of ingenuity and creativity</li>\n<li>Analyzes incident data and victim environments to recommend targeted mitigations</li>\n<li>Advise technical personnel on countermeasure implementation and customization</li>\n<li>Supports internal stakeholders on containment and eradication missions</li>\n<li>Documents analysis in a standardized knowledgebase for sharing and publication</li>\n<li>Assists in maintaining branch process and procedure documentation</li>\n<li>Guides the completion of hunt and incident response activities</li>\n"
    },
    {
      "text": "Minimum Qualifications",
      "content": "\n<li>BS Computer Science, Cyber Security, Computer Engineering, or related degree; or HS Diploma &amp; 7+ years of technical experience in the area of expertise.</li>\n<li>5+ years of directly relevant experience in the area of expertise</li>\n<li>Must be able to travel domestically on short notice</li>\n<li>Strong understanding of network architecture/security</li>\n<li>Experience performing cyber incident response</li>\n<li>Ability to think independently</li>\n<li>Demonstrates superior written and oral communication skills</li>\n<li>Must be able to work collaboratively across physical locations</li>\n<li>Skilled in identifying different classes of attacks and attack stages</li>\n<li>Understanding of system and application security threats and vulnerabilities</li>\n<li>Understanding of proactive analysis of systems and networks, to include creating trust levels of critical resources</li>\n<li>Proficiency with common operating systems (e,g, Linux/Unix, Windows)</li>\n"
    },
    {
      "text": "Preferred Qualifications",
      "content": "\n<li>Experience leading and mentoring technical teams</li>\n<li>Knowledge of Computer Network Defense policies, procedures and regulations</li>\n<li>Knowledge of different operational threat environments (e.g., first generation [script kiddies], second generation [non nation-state sponsored], and third generation [nation-state sponsored])</li>\n<li>Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, PL/SQL and injections, race conditions, covert channel, replay, returnoriented attacks, and malicious code)</li>\n<li>Network and System administration experience</li>\n<li>Strong understanding of adversarial tactics/techniques/procedures (TTPs)</li>\n<li>Experience with Identity and Access Management (IAM) tools</li>\n<li>Ability to review and analyze Enterprise Architecture (EA) from a security perspective</li>\n<li>Understanding of cyber defense-in-depth principles</li>\n<li>Hands-on skill in host/network intrusion detection</li>\n<li>Ability to perform event correlation&nbsp;</li>\n<li>Experience with malicious activity analysis</li>\n<li>Ability to collaborate with stakeholders at multiple levels within an organization</li>\n<li>Desired Certifications: One or more<br>DoD 8140.01 IAT Level II, IASAE II, CSSP Analyst<br>DoD 8140.01 GCIA, GCIH, CSSP Analyst/CSSP Incident Responder<br>DoD 8140.01 CEH, CSSP Analyst</li>\n<li>SANS GIAC GNFA preferred</li>\n<li>SANS GRID, GICSP, or GCIP a plus</li>\n"
    }
  ],
  "country": "US",
  "createdAt": 1775184494595,
  "updatedAt": null,
  "categories": {
    "team": "0008-0003",
    "location": "Arlington, VA",
    "commitment": "Full-time",
    "department": "Incident Response Expert",
    "allLocations": [
      "Arlington, VA"
    ]
  },
  "salaryRange": null,
  "workplaceType": "onsite"
}