Senior Cybersecurity Incident Response Specialist

Requirements:

• High school diploma or GED; a bachelors degree in computer science or equivalent is preferred.
• At least five years of hands-on experience, including proven ability to detect, triage, and respond to cyber incidents across enterprise networks and cloud environments.
• Proficiency with SIEM, EDR/XDR platforms, and forensic tools.
• Strong understanding of threat actor tactics, techniques, and procedures (TTPs), the MITRE ATT&CK framework, and incident containment strategies.
• Ability to analyze network traffic, logs, and endpoint telemetry to identify malicious activity; familiarity with malware analysis, reverse-engineering basics, and memory analysis concepts.
• Experience developing and tuning detection rules, playbooks, and automated response workflows.
• Working knowledge of incident response frameworks such as NIST SP 800-61 and SANS, plus vulnerability management, threat intelligence integration, and SOC metrics and reporting.
• Understanding of computer and networking fundamentals, including Windows and Linux/Unix, routing, switching, VLANs, subnets, firewalls, and protocols such as SSH, SMB, SMTP, FTP/SFTP, HTTP/HTTPS, and DNS.
• Familiarity with Active Directory, Group Policy, Microsoft Azure services, system logging technologies, and retrieving information from varied technology platforms.
• CompTIA Security+ certification is required.
• Ability to work effectively on a team, take initiative with little supervision, adapt to new or open-ended tasks, and research and learn independently.
• Strong analytical and decision-making skills under pressure, with excellent written and verbal communication skills, including incident documentation and executive briefings.
• Ability to lead investigations, mentor junior analysts, and collaborate with cross-functional teams.
• U.S. citizenship is required; selected applicants must undergo a government security investigation and meet eligibility requirements for access to classified information.
• Preferred: interest in security or hacking culture and ability to think like an attacker.
• Preferred: one or more cybersecurity certifications, such as Microsoft AZ-900, CompTIA CySA+, CEH, or GIAC GCIH; cloud security certifications such as CompTIA Cloud+, CCSP, or CCSK; or Microsoft 365/Azure security certifications such as SC-200, SC-900, AZ-900, or AZ-500.
• Preferred: familiarity with Microsoft 365 and Azure products, including Microsoft Sentinel and Microsoft 365 Defender; Microsoft Sentinel SIEM, Kusto Query Language (KQL), mobile devices, scripting with PowerShell or Python, Power BI, and Azure DevOps.
• Preferred: AI/ML expertise, including in-depth knowledge of AI and ML concepts, practical application to cyber threat hunting and incident response, and experience with AI services in Microsoft Azure.
• Must pass a pre-employment drug screening and have acceptable background check results.
• If required by the contract, must obtain and maintain the required security clearance and be able to access military installations.
• Must maintain mental alertness and be able to meet physical demands that may include bending, stooping, and prolonged sitting, walking, or standing, with reasonable accommodation as applicable.
• Must be willing to work on site in Washington, DC, including swing or overnight shifts.

Responsibilities:

• Join our SOC team, which provides around-the-clock monitoring and incident response for organizational networks, systems, applications, and web services.
• Provide senior-level cybersecurity incident response expertise in support of client processes and procedures.
• Develop operational baselines, including data flows and application interactions, to strengthen SOC incident response.
• Prepare, maintain, and regularly review incident response playbooks, scenarios, narratives, and visual diagrams in accordance with NIST SP 800-61, government guidance, and client direction.
• Monitor system status and sensor data, and validate and triage information from SIEM systems, email, text messages, phone calls, and enterprise dashboards.
• Analyze network traffic, identity, fault, performance, and bandwidth information, along with alerts and other data, to detect anomalies and unauthorized activity.
• Meet with client stakeholders to develop content, analytic rules, alerts, dashboards, and automation, and identify improvements to incident response availability and efficiency.
• Categorize, prioritize, and report cybersecurity events in accordance with standard operating procedures and relevant policies.
• Implement cybersecurity mitigations using client tools and systems.
• Create and escalate cybersecurity investigations to internal and external organizations, including DHS and other government agencies, within client and federal timelines.
• Coordinate and respond to FOIA requests, audits, data calls, e-discovery, and other information requests.
• Schedule and conduct annual incident response tabletop exercises for each client FISMA system.
• Review and handle phishing messages reported by client staff.

Technologies:

• AI
• Active Directory
• Azure
• Cloud
• DevOps
• HTTP
• Support
• Linux
• Microsoft 365
• Mobile
• Network
• Power BI
• PowerShell
• Python
• Security
• SMB
• Swing
• Unix
• Web
• Windows
• Office 365
• Android
• Machine Learning
• iOS

More

We are Bering Straits Professional Services, LLC (BSPS), providing global logistics, training, and procurement services to U.S. Government agencies. We are an SBA-certified 8(a) contractor and have held ISO 9001 certification since February 2022 through the Performance Review Institute. This senior cybersecurity incident response role is based on site in Washington, DC, and offers an annual salary range of $100,000–$120,000. The SOC operates 24/7/365, and this role may involve swing or overnight shifts. The position has no supervisory responsibilities and is primarily performed in a modern office, with extensive computer use and occasional travel. We give hiring, promotion, training, and retention preference to qualified BSNC shareholders, their descendants, and their spouses. We are an equal opportunity employer.

last updated 43 week of 2026