Responsibilities:

• Incident Response:
• Lead and coordinate incident response efforts to detect, analyze, contain, and remediate security incidents.
• Conduct forensic analysis, root cause identification, and provide post-incident reports with detailed remediation recommendations.
• Develop and maintain incident response playbooks and workflows in alignment with industry best practices.
• SOC Operations:
• Monitor and respond to alerts generated by security tools and systems, including SIEM platforms, IDS/IPS, endpoint protection, and network security appliances.
• Act as a primary escalation point for SOC analysts and provide guidance on complex incidents.
• Perform threat hunting, anomaly detection, and proactive monitoring to identify potential threats and vulnerabilities.
• Compliance and Regulatory Frameworks:
• Ensure the organization’s security posture aligns with federal standards, including FISMA, FIPS, SAP, and PPSM.
• Collaborate with compliance and governance teams to meet auditing requirements and maintain necessary certifications.
• Develop, implement, and maintain policies and controls to ensure compliance with relevant cybersecurity standards.
• Threat Intelligence and Vulnerability Management:
• Integrate threat intelligence into incident response activities, improving detection and response capabilities.
• Participate in vulnerability assessments and coordinate patch management and remediation efforts with relevant IT teams.
• Stay informed about the latest threat vectors, vulnerabilities, and attack methodologies to continuously improve defenses.
• Documentation and Reporting:
• Generate reports and metrics for security incidents, vulnerabilities, and compliance adherence.
• Document and maintain cybersecurity policies, standard operating procedures (SOPs), and incident response playbooks.
• Conduct training and awareness sessions for the team on cybersecurity best practices and compliance requirements.