> Markdown version of [/jobs/ext/3692609-cyber-incident-manager](https://www.wearedevelopers.com/jobs/ext/3692609-cyber-incident-manager). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Cyber Incident Manager

- **Company:** Argo Cyber Systems
- **Location:** Washington, DC, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, JIRA, Cyber Security, Information Systems, Linux, Network Security, Network Forensics, Security Information and Event Management, Wireshark, Malware, Information Technology, Cybercrime, Cyber Warfare, Splunk, SentinelOne Expertise, Servicenow, Vulnerability Analysis
- **Published:** October 11, 2026
- **Apply:** https://www.juju.com/job/16_0ea89ddc

## About the Role

* U.S. Citizenship
 * Active TS/SCI clearance (must be able to obtain DHS EOD Suitability)
 * 5+ years of directly relevant experience in cyber incident management, SOC operations, or DFIR roles
 * Strong understanding of incident response methodologies, frameworks, and reporting requirements under NIST SP 800-61 and FISMA
 * Demonstrated ability to analyze, prioritize, and document incidents within enterprise or federal environments
 * Solid grasp of attack lifecycle stages and common adversary tactics (reconnaissance, exploitation, privilege escalation, persistence, exfiltration, etc.)
 * Knowledge of system administration, OS hardening, and defensive security controls across Windows, Linux, and hybrid environments
 * Familiarity with CND policies, procedures, and regulatory frameworks
 * Understanding of threat actor typologies (e.g., opportunistic, organized criminal, nation-state) and their operational tradecraft
 * Excellent written and verbal communication skills for technical and executive reporting, * Proficiency with SIEM, EDR, and network forensic tools (e.g., Splunk, SentinelOne, Elastic, Wireshark)
 * Experience conducting or managing shift-based or 24×7 cyber operations
 * Advanced knowledge of malware analysis, log correlation, and network defense methodologies
 * Familiarity with incident ticketing and tracking systems (e.g., ServiceNow, Jira, Remedy)
 * Strong analytical mindset and ability to lead during high-pressure operational events, * Bachelor's Degree in Cybersecurity, Information Systems, Computer Science, or related discipline
or

 * High School Diploma with 7-9 years of relevant incident management or cybersecurity experience

## Description

Argo Cyber Systems is seeking a Cyber Incident Manager to lead onsite incident response operations for a U.S. Government customer. The selected candidate will coordinate and execute incident handling, forensic triage, and threat mitigation activities for large-scale, high-impact cyber events. This role is part of a 24×7 incident response capability that provides immediate investigation, containment, and recovery support to federal civilian agencies and critical infrastructure entities., * Direct and coordinate incident response activities across diverse environments-ensuring rapid containment, accurate impact assessment, and effective recovery.

 * Correlate and analyze incident data to identify patterns, trends, and emerging threats.
 * Perform triage and scoping of cyber incidents to determine severity, urgency, and operational impact.
 * Apply Defense-in-Depth principles and best practices to strengthen enterprise resilience.
 * Investigate indicators of compromise (IOCs), malware behavior, and intrusion vectors using host and network data.
 * Research and document resolution steps, mitigations, and workarounds for ongoing or recurring incidents.
 * Develop and maintain incident response procedures and playbooks aligned with NIST SP 800-61 Rev.2 and FISMA reporting requirements.
 * Monitor external intelligence sources and threat feeds to maintain situational awareness of current threat conditions.
 * Track, document, and brief incident lifecycle progress from detection through closure, ensuring accurate reporting and escalation to senior stakeholders.
 * Collaborate with cross-functional teams-including threat analysts, forensics personnel, SOC operators, and federal incident coordinators-to provide unified, mission-focused response.