Cyber Incident Manager

Job Title: Cyber Incident Manager
Location: Arlington, VA (On-Site)
Clearance: Active TS/SCI Required
Company: Quantum Science Solutions (QSS)
Compensation: Open Rate

Position Overview
Quantum Science Solutions (QSS) is seeking an experienced Cyber Incident Manager to support mission-critical cybersecurity operations through incident triage, analysis, documentation, coordination, and resolution. This role is responsible for managing Computer Network Defense (CND) incidents from initial detection through final resolution while supporting enterprise cyber defense activities and incident reporting requirements.
The selected candidate will analyze network alerts, correlate incident data, identify trends, determine incident scope and urgency, and coordinate with internal teams to support timely mitigation and response. This position requires strong knowledge of incident response methodologies, cybersecurity operations, attack stages, vulnerability categories, and Federal incident reporting standards.

Key Responsibilities
• Perform Computer Network Defense incident triage to determine incident scope, urgency, severity, and potential enterprise impact.
• Receive, review, and analyze network alerts from multiple enterprise sources to determine possible causes and required response actions.
• Correlate incident data to identify trends, recurring issues, and patterns in reported cybersecurity incidents.
• Track and document CND incidents from initial detection through final resolution.
• Coordinate with internal components and stakeholders to gather information related to ongoing incidents.
• Research and compile known resolution steps, workarounds, and mitigation actions to support incident response efforts.
• Apply cybersecurity concepts to detect, analyze, and defend against intrusions across small and large-scale IT networks.
• Conduct cursory analysis of log data to identify potential indicators of compromise or suspicious activity.
• Monitor external data sources to maintain awareness of current CND threat conditions and assess potential enterprise impact.
• Identify incident causes and determine key information needed from external entities regarding infection vectors and background details.
• Prioritize incidents and support escalation to specialized analysts when advanced investigation is required.
• Analyze phishing-related activity and describe tactics, techniques, and indicators associated with phishing campaigns.
• Recognize gaps in incident reporting and recommend improvements to support accurate and complete documentation.
• Recommend defense-in-depth principles and practices, including layered defenses, security robustness, and defense in multiple places.
• Support shift-based cyber operations, incident triage, IOC research, and escalation workflows as assigned.

Mandatory Skills
• U.S. Citizenship.
• Active TS/SCI clearance.
• Ability to obtain DHS Suitability.
• Minimum of 5+ years of directly relevant experience in cyber incident management, incident response, or cybersecurity operations.
• Knowledge of incident response and incident handling methodologies.
• Familiarity with NIST 800-62 and FISMA standards as they relate to incident reporting.
• Ability to prioritize incidents based on scope, urgency, and potential impact.
• Experience investigating and describing tactics used in phishing campaigns.
• Ability to recognize gaps in incident reporting and recommend corrective actions.
• Knowledge of general attack stages, including footprinting, scanning, enumeration, gaining access, privilege escalation, maintaining access, network exploitation, and covering tracks.
• Skill in recognizing and categorizing vulnerabilities and associated attack types.
• Knowledge of basic system administration and operating system hardening techniques.
• Knowledge of Computer Network Defense policies, procedures, and regulations.
• Knowledge of operational threat environments, including non-nation-state and nationstate sponsored threats.
• Knowledge of system and application security threats and attack methods, including buffer overflow, mobile code, cross-site scripting, PL/SQL and injection attacks, race conditions, covert channels, replay attacks, return-oriented attacks, and malicious code.

Preferred Skills
• Additional experience with operational threat environments, including first generation, second generation, and third generation threat actors.
• Additional knowledge of system and application security threats and attack methods.
• Experience supporting cyber operations centers, incident response teams, or enterprise security operations.
• Experience performing event correlation, IOC research, and cyber incident escalation.
• Strong written and verbal communication skills.
• Strong analytical, documentation, and problem-solving abilities.

Education
• Bachelor’s degree in Incident Management, Operations Management, Cybersecurity, or a related discipline.
OR
• High School Diploma with 7–9 years of incident management or cybersecurity experience.

Desired Certifications
• GIAC Certified Incident Handler (GCIH)
• GIAC Certified Forensic Analyst (GCFA)
• GIAC Information Security Professional (GISP)
• GIAC Certified Enterprise Defender (GCED)
• Certified Cyber Forensics Professional (CCFP)
• Certified Information Systems Security Professional (CISSP)

Why QSS?
At QSS, you'll help shape the future of cybersecurity operations by supporting mission-critical technology integration and modernization efforts that strengthen the nation's cyber defense capabilities.
Benefits Include:
• Competitive compensation with annual performance bonuses
• Premium Medical, Dental, & Vision coverage
• Generous PTO plus Federal Holidays
• 401(k) with company match
• Professional development and certification support