Cybersecurity Incident Commander Jobs in Virginia

ASRC Federal is seeking a highly skilled and experienced Cyber Incident Responder to join our dynamic team on the day shift (0600 – 1600), providing extended-hours coverage that includes weekend and holiday rotations. This is a fully on-site position at Quantico Marine Corps Base, VA — no telework is available for this role.

The successful candidate will serve as a front-line defender, rapidly detecting, triaging, containing, and eradicating cyber threats across our enterprise infrastructure. This role is critical for minimizing the impact of security incidents, coordinating response actions, and preserving forensic evidence in support of Department of Defense (DoD) missions.

Position Description:

The Cyber Incident Responder is a vital role responsible for executing the full incident response lifecycle during day shift, weekend, and holiday coverage windows. This position focuses on detecting and responding to security incidents in real time, performing containment and eradication actions, and coordinating recovery efforts using enterprise tools such as SIEM, SOAR, CrowdStrike, CyberArk, and Endpoint Security Suite (ESS).

The Incident Responder will collaborate with cross-functional IT and security teams to:

• Execute incident response procedures in accordance with NIST SP 800-61 and DoD guidelines
• Coordinate with JFHQ-DODIN on cyber incident reporting and remediation
• Support insider threat response and investigations
• Contain and remediate compromised systems, accounts, and endpoints
• Preserve and document forensic evidence for incident case management
• Maintain incident response playbooks and ensure high operational readiness during all covered hours

Minimum Requirements: 

• At least Five (5) years of hands-on technical cybersecurity experience and knowledge of incident response concepts, Computer Network Defense, DISA Security Technical Implementation Guides (STIGs), DoD A&A Process, NIST SP 800-53, NIST SP 800-61, CJCSM 6510.01B, United States Cyber Command guidelines, and other applicable DoD Cyber Security and Computer Network Defense policies.
• Active Top-Secret Clearance REQUIRED, eligible to be upgraded to TS/SCI.
• Bachelor’s degree in Information Technology, Information Systems Management, Cyber Security, or equivalent experience.
• Must meet DoD 8570 certification requirements at time of hire — IAT Level II (e.g., CCNA Security, CySA+, GICSP, GSEC, Security+, SSCP); CSIH, GCIH, or GCFA preferred for incident handling.
• Willingness and availability to work the day shift (0600 – 1600), including weekend and holiday rotations, fully on-site at Quantico, VA.

Required Skills:

• Knowledge of computer network defense concepts, DISA Security Technical Information Guides, DoD A&A Process, NIST SP 800-53, NIST SP 800-61, CJCSM 6510.01 B, United States Cyber Command guidelines, and other applicable DoD Cybersecurity and Computer Network Defense Policies Cybersecurity and Computer Network Defense policies
• Develop, maintain, and provide a weekly brief that captures all the cyber events including metrics and trends.
• Ability to provide continuous monitoring, data to include but not limited to network and host vulnerability scanning IDS, firewall, network sensor tuning, net flow/packet capture (PCAP). Collect and keep audit data in order to conduct a technical analysis relating to misuse, penetration, or other incidents.
• Document incidents, response actions, and remediation recommendations in accordance with government reporting requirements. 
• Monitor multiple environments for malicious or anomalous activity using SIEM, SOAR, and on-prem security tooling. 
• Analyze logs, telemetry, alerts, and audit data to identify indicators of compromise (IOCs) and attack patterns. 

Work Environment and Physical Demands: 

• This is a fully on-site position at DCSA facilities, Quantico Marine Corps Base, VA. Telework is not offered for this shift.
• Must work the assigned day shift (0600 – 1600) and support weekend and holiday coverage as scheduled.
• Must be able to communicate complex technical ideas to a diverse customer base, both verbally and in written form.