Defensive Cybersecurity Engineer/Incident Response

Join mission-driven defensive cybersecurity work supporting government sponsors through SOC operations expertise, incident response training, and practical detection engineering. This onsite role in McLean, VA emphasizes applied work across telemetry analysis, threat hunting, and cost-effective use of AI techniques to improve real-world security operations.

Compensation for this Defensive Cybersecurity Engineer/Incident Response position ranges from $158,800 to $238,200 annually, with a noted midpoint of $198,500.

Responsibilities

• Serve as a subject matter expert to government sponsors on enterprise security operations centers (SOCs), including daily operations, governance, and process improvement.
• Convert complex defensive cybersecurity concepts into practical training aligned to sponsors’ network topologies, staffing, funding, and technical resources.
• Create hands-on training scenarios and exercises that mirror real-world incident response challenges and sponsor mission needs.
• Support sponsor incident response planning by helping develop, assess, and improve incident response plans, playbooks, and workflows for investigating, containing, and recovering from cyber incidents.
• Use MITRE ATT&CK to characterize adversary behavior, support incident investigations, and identify opportunities to strengthen defenses.
• Design, develop, and refine security detections, analytics, and dashboards, including integration of new data sources into SIEM platforms.
• Analyze and correlate endpoint, network, and cloud telemetry to determine incident scope, assess impact, and inform containment and remediation recommendations.
• Assess SOC and incident response capabilities, identify operational and technical gaps, and recommend improvements tied to sponsor mission priorities and available resources.
• Contribute to post-incident reviews and exercises by translating lessons learned into improvements across response procedures, detection coverage, and operational readiness.
• Research and evaluate emerging artificial intelligence techniques, including machine learning and generative AI, with a focus on practical, cost-effective SOC and incident response applications.

Requirements

• Typically requires a minimum of 8 years of related experience with a Bachelor’s degree; or 6 years with a Master’s degree; or a PhD with 3 years of experience; or an equivalent combination of related education and work experience.
• Minimum of 3 years of operational experience.
• Bachelor’s degree in Computer Science, Cybersecurity, Data Science, Applied Mathematics, Statistics, or a related field.
• Knowledge of incident response operations and principles and their application.
• Hands-on experience with generative AI or AI-enabled technologies, including the ability to apply them to cybersecurity investigation, incident response, threat analysis, or security automation.
• Experience developing technical training content, curriculum, courseware, or other learning materials for cybersecurity audiences.
• Strong technical writing, presentation, and facilitation skills.
• Ability and willingness to travel up to 25%, including international locations, to deliver training at customer sites.
• Eligibility to obtain and maintain a Top Secret U.S. Government issued Security Clearance, which requires being a U.S. Citizen.
• Onsite requirement of at least 3 days per week.

Preferred Qualifications

• Comfort presenting to non-English-speaking audiences with translation support.
• Experience applying MITRE ATT&CK to support cybersecurity operations.
• Experience leading incident response efforts and teams within a security operations center, incident response organization, or fly-away team.
• Experience developing incident response playbooks, tabletop exercises, or operational training scenarios.
• Experience leading technical training sessions for government, partner, or other technical audiences.
• Experience creating hands-on cybersecurity labs, exercises, or scenario-based learning materials.
• Experience with Splunk or Elastic/ELK.
• Experience integrating AI-enabled workflows with cybersecurity platforms such as SIEM, SOAR, EDR/XDR, threat-intelligence, case-management, or cloud-security platforms.

Technologies

• MITRE ATT&CK
• SIEM
• Splunk
• Elastic/ELK
• SOAR
• EDR/XDR
• Threat-intelligence
• Case-management