Cyber Incident Response Team (CIRT) Lead

Founded in 1989, SOSi is among the largest private, founder-owned technology and services integrators in the defense and government services industry. We deliver tailored solutions, tested leadership, and trusted results to enable national security missions worldwide.

**This position is contingent upon contract award**

SOSi is seeking highly qualified senior professionals to support a DHS enterprise cybersecurity program providing 24/7 Security Operations Center (SOC) services. These roles deliver leadership, operational oversight, and technical expertise across cyber defense, incident response, intelligence, engineering, and modernization activities.

Job Description

Leads the end-to-end incident response function for the DHS enterprise SOC, coordinating triage, containment, eradication, and recovery; drives tool efficacy (SIEM/EDR/IDS/IPS), case management, and communications with stakeholders.

Responsibilities

• Lead incident detection, analysis, escalation, and coordinated response across SOC towers.
• Standardize IR runbooks, playbooks, and communications; ensure evidence handling and documentation.
• Measure and improve MTTA/MTTR; track lessons learned and corrective actions.
• Ensure IR alignment to DHS/CBP policy and reporting requirements.

• Education: Bachelor’s of Science in computer engineering, computer science, IT or cyber security (or eight (8) years of relevant work experience in lieu of a degree). 
• Experience: 5+ years of progressively responsible experience in cyber security, information security, security engineering, network engineering with emphasis in cyber security issues and operations, computer incident response, systems architecture, or data management.
• Certifications (Required): CISSP and have one or more of the following certifications: SANS GIAC Certified Intrusion Analyst (GCIA), SANS GIAC Certified Incident Handler (GCIH); SANS GIAC Certified Forensic Analyst (GCFA); SANS GIAC Certified Enterprise Defender (GCED) or other Information Assurance Technician (IAT) Level III certification in accordance with DoD 8140.
• Technical Proficiency: SIEM, EDR, IPS/IDS, and case management platforms.
• Clearance: TS, SCI-eligible.

Work Environment

• Normal office conditions with potential to perform duties in various CONUS locations.
• Core hours of operation are Monday through Friday, 0600 – 1700.
• May be requested to work evenings and weekends to meet program and contract needs.

Working at SOSi

All interested individuals will receive consideration and will not be discriminated against for any reason.