Join our Talent Network >

Cyber Incident Response Lead

This job posting is no longer active.

Job ID: 2113551
Location: PORTLAND, OR, United States
Date Posted: Sep 22, 2021
Category: Cyber
Subcategory: Cyber Engineer
Schedule: Full-time
Shift: Day Job
Travel: No
Minimum Clearance Required: Interim Secret
Clearance Level Must Be Able to Obtain: Secret
Potential for Remote Work: Yes
Benefits: Click here

Share: mail

Job Description


Job Description: SAIC has an opportunity for a Cyber Incident Response Team (CIRT) Lead to support the US Army Corps of Engineers Revolutionary IT Services (USACE RITS) program.  The ideal candidate will be the point of contact for monitoring agency networking environments, including cloud, DMZs and secure LANs, as required by the USACE OCIO/G-6. The service shall also support connectivity to extranets and the internet. In this role you will also be leading an Incident Response Team of 14 cyber professionals - so this is a great opportunity for someone who is also interested in leadership opportunity.
Location: This position is 100% remote.
About the Program: The USACE RITS contract will provide modern and secure enterprise-wide IT support services to approximately 37,000 USACE customers located throughout the CONUS and OCONUS. Services will support the mission needs of USACE’s Headquarters (HQs) located in Washington, D.C., nine Divisions and 43 Districts, to include over 1,500 field and area project offices and two data centers that are currently located in Vicksburg, Mississippi, and Hillsboro, Oregon.
Major incident response duties include:
  • Responding to alerts and violations identified, in accordance with cyber policy and incident response plans, as part of the SIEM.
  • Identifying incident threat level and nature based on the received alert or violation.
  • Identifying root cause, source, and methodology used to properly categorize the incident.
  • Providing AR 380-53 Network Damage Assessment, if necessary.
  • Gathering host logs from compromised system(s).
  • Taking corrective action to contain the incident, prevent further spread, and protect systems.
  • Providing forensically sound evidence collection and capabilities.
  • Eradicating the malicious event from infected hosts/network as directed by USACE OCIO/G-6.
  • Providing cyber clean-up as required, including the restoration of damaged data.
  • Recommending mitigating actions to prevent future infections or reinfection.
  • Configuring and fine-tuning detection/prevention capabilities.
  • Providing cyber After Action Reports (AARs), including lessons learned and final network damage assessment as identified by USACE OCIO/G-6.
  • Providing analysis, correlation, and trending of anomalous events and incidents.
  • Supporting incident response team deployment to USACE OCIO/G-6 locations.
  • Coordinating and sharing data with other Federal agencies and DoD commands as directed by USACE OCIO/G-6.
  • Providing analysis and reverse engineering of cyber threats.
  • Implementing mitigation measures in response to general or specific threats on the respective networks in accordance with USACE OCIO/G-6 directives.
Major duties with monitoring include:
  • Providing analysis and monitoring for all systems and environments to ensure the availability, integrity, and confidentiality of the data processed, stored, and transmitted via a centralized support monitoring service. Analysis and monitoring shall be automated to the maximum extent possible.
  • Providing Intrusion Detection System/Intrusion Prevention System (IDS/IPS) support:
  • Implementing, administering, and maintaining threat sensors based on current threat directives and recommendations.
  • Developing, testing, and distributing threat sensor baseline signatures.
  • Developing IDS/IPS test plans, operational procedures, and maintenance plans.
  • Providing host-based intrusion detection monitoring and prevention on all devices, including those supporting Host-Based Security Systems (HBSSs).
  • Providing data feeds from all intrusion detection and prevention modules for incorporation into the Enterprise Security Incident Management System, for CorpsNet, cloud, DMZ, and SIPR in accordance with classification guidance.
  • Providing continuous monitoring of malware protection and detection mechanisms.
  • Providing administrator access to the designated Government POCs as required.
  • Providing active monitoring of the operational status, health, and performance of the monitoring tools and devices.
  • Actively monitoring vendor feeds, Army feeds, tippers, OPORDS, sensor grids, and intelligence feeds for new signature information.
  • Analyzing the information provided and providing recommendations for inclusion into the CorpsNet, and SIPRNet environments, while maintaining the classification of information.
  • Providing performance measurements, logs, and information feeds from the security monitoring systems (e.g., HBSS and IPS).
  • Maintaining access to current network architecture diagrams per DISA standards showing placement of sensors (e.g., IDS/IPS, Routers, Netflow/PCAP systems, firewall, etc.).
  • Reporting on access to assets, including, but not limited to, network and host-based sensors for CorpsNet, CorpsNet extended network (JRSS and cloud), and SIPRNet.
  • Integrating and correlating data from USACE systems, servers, services, SIEM, and end points to measure, monitor, remediate, and remove threats to the environment in accordance with USACE OCIO/G-6 directives.


  • Bachelors and nine (9) years or more experience; additional four (4) years experience in lieu of degree.
  • At least 4 years of experience directly related to cyber incident response and cyber forensics. 
  • Experience managing or leading a team.
CERTIFICATION REQUIRED:  Must have at least one of the following
  • CEH – Certified Ethical Hacker
  • CySA+ - Cybersecurity Analyst Plus
  • GICSP - GIAC Global Industrial Cyber Security Professional
  • SSCP - Systems Security Certified Practitioner
  • CFR - CyberSec First Responder
CLEARANCE REQUIREMENT:  Must have an Interim Secret clearance with ability to obtain and maintain a Secret clearance

COVID Policy: Prospective and/or new employees will be required to adhere with SAIC's vaccination policy. Full vaccination will be required before the start of employment in order to work onsite at an SAIC location. If applicable, prospective or new employees may seek an exemption to the vaccination requirement at Contact Us and must have an approved exemption prior to the start of their employment. Employees working onsite at a customer location must comply with customer requirements which may include mandatory vaccination, mandatory attestation regarding one's vaccination status and mandatory weekly or bi-weekly testing.
Target salary range: $115,001 - $125,000. The estimate displayed represents the typical salary range for this position based on experience and other factors.


SAIC is a premier technology integrator solving our nation's modernization and readiness challenges. Our offerings across defense, space, civilian, and intelligence markets include high-end solutions in engineering, IT, and mission outcomes. We integrate the best components from our portfolio with our partner's ecosystem to deliver innovative and effective solutions. We are 25,500 strong; driven by mission, united by purpose, and inspired by opportunities. Headquartered in Reston, VA, SAIC has annual revenues of nearly $7.1 billion. For information, visit or Working at SAIC for benefits details. SAIC is an Equal Opportunity Employer empowering people no matter their race, color, religion, sex, gender identity, sexual orientation, national origin, disability, or veteran status. We strive to create a diverse, inclusive and respectful work culture that values all.

Share: mail

Similar Jobs

Senior Splunk Engineer

PORTLAND, OR, United States

Cyber Engineer

PORTLAND, OR, United States