Incident Commander (Tier 3)

Be an Early Applicant Remote Hiring Remotely in US Senior level Remote Hiring Remotely in US Senior level Leads Tier 3 cybersecurity incident response across a 24x7x365 function. Coordinates containment, remediation, recovery, investigations, stakeholders, and communications during complex incidents such as breaches and ransomware attacks. Performs advanced triage, threat analysis, log and endpoint analysis, digital forensics coordination, incident tracking, executive reporting, and post-incident reviews. Uses Splunk, Microsoft Defender, Cortex XSOAR, and related security tools while ensuring compliance with federal requirements and cybersecurity policies. The summary above was generated by AI, *MUST HAVE one of the following ACTIVE certifications: CISSP (Certified Information Systems Security Professional) certification from ISC2, plus GCIH (GIAC Certified Incident Handler) or an equivalent relevant incident response, digital forensics, or cybersecurity certification.

As cybersecurity incidents exceed the capabilities and scope of Tier 2 operations, the Tier 3 Incident Commander serves as the senior operational lead responsible for coordinating advanced incident response, driving resolution, and ensuring effective communication across stakeholders. The Tier 3 Incident Commander leads a 24x7x365 incident coordination function, responding to escalated alerts, notifications, and incident reports. Responsibilities include establishing and maintaining incident situational awareness, tracking incident progression, coordinating response and remediation activities, facilitating recovery efforts, communicating with stakeholders, and delivering timely, accurate incident reporting.

The role requires the ability to assess complex cybersecurity events, analyze adversary motives, capabilities, and opportunities, and determine the potential impact, scope, and severity of an incident. The Incident Commander ensures that incident reports are accurately documented in the incident tracking system, coordinates with reporting entities to validate information and establish a comprehensive understanding of the event, and identifies additional investigative, containment, remediation, or recovery actions required to achieve resolution.

The Tier 3 Incident Commander must possess extensive knowledge of cybersecurity incident response, anomaly detection and analysis, security log analysis, digital forensics, threat vectors, and adversary tactics and techniques. The individual must be able to interpret technical findings, assess incident reports, exercise sound judgment, and direct or coordinate appropriate response activities based on established procedures and incident requirements. The role also requires strict adherence to standard operating procedures (SOPs), organizational policies, and established escalation, notification, and reporting protocols, including the timely notification and communication of incidents to Federal leadership.

Required technical expertise includes a strong working knowledge of Splunk Security Information and Event Management (SIEM), Microsoft Defender Endpoint Detection and Response (EDR), Palo Alto Networks Cortex XSOAR, and supporting digital forensic and incident response tools., * Conduct advanced incident response analysis to identify attack vectors, assess threats, and investigate malware, data exposure, phishing, social engineering, and other cybersecurity incidents.

• Coordinate incident containment, remediation, and recovery activities to mitigate threats and restore affected systems and services.
• Monitor and analyze security events and alerts from Splunk SIEM and other security tools; review escalated alerts and perform Level 3 incident triage to determine incident type, severity, scope, risk, and appropriate response or escalation.
• Serve as the primary point of coordination for incident management, assigning response actions and coordinating stakeholders, enterprise teams, resources, and timelines during significant incidents, including data breaches and ransomware attacks.
• Create, maintain, and track incident records and ticket queues from initial detection through investigation, remediation, resolution, and closure, ensuring accurate documentation and compliance with federal requirements, departmental policies, and applicable legislation.
• Evaluate and recommend technical, procedural, and physical security controls to address vulnerabilities, mitigate incident impact, reduce risk, and prevent recurrence.
• Prepare incident status reports, executive briefings, and post-incident reports documenting findings, response actions, remediation, recovery, lessons learned, and restoration of normal operations.
• Collaborate with digital forensic investigators and application security analysts on incident investigations and threat-hunting activities, conducting or coordinating endpoint, network, and log analysis to identify indicators of compromise, determine incident scope, and support root-cause analysis., Leads product marketing strategy for CrowdStrike’s cloud risk and developer security portfolio. Owns positioning, launches, messaging, analyst engagement, field readiness, technical content, competitive strategy, thought leadership, and adoption. Partners with Product and CTO leaders to shape roadmap and market direction, creates technical proof for cloud and application security audiences, and uses customer, pipeline, usage, and competitive insights to improve business outcomes. Top Skills: Ai TechnologiesAspmAWSCi/CdCiemCloud Vulnerability ManagementCnappContainer SecurityCspmExposure ManagementGCPImage SecurityInfrastructure As CodeKspmKubernetesAzureSoftware Composition Analysis, CrowdStrike

• Minimum of 7 years of relevant professional experience, or a bachelor’s degree with at least 3 years of relevant experience.
• Must be a U.S. citizen and able to complete a federal background investigation for a High-Risk Public Trust position, including applicable credit checks.
• Must hold CISSP certification from ISC2, plus GCIH (GIAC Certified Incident Handler) or an equivalent relevant incident response, digital forensics, or cybersecurity certification.
• Extensive experience managing cybersecurity incidents, performing advanced incident triage, coordinating response activities, and driving investigations through resolution.
• Demonstrated proficiency in Security Operations Center (SOC) operations, threat hunting, intrusion detection and prevention, security event monitoring, and incident detection and response.
• Expert knowledge of TCP/IP protocols, network traffic analysis, intrusion detection and prevention systems (IDS/IPS), and security log analysis, including the ability to distinguish genuine threats from false positives.
• Experience with endpoint security, antivirus, endpoint detection and response (EDR), host-based intrusion detection, firewalls, proxies, web application firewalls (WAF), and other enterprise security solutions, including FireEye products.
• Extensive experience analyzing and correlating security logs from diverse systems and security devices, identifying suspicious activity, and collecting relevant host, network, and cloud data to support investigations.
• Strong understanding of Windows and Unix/Linux operating systems, enterprise networking, system and application security, systems and network administration, and operating system hardening.
• Knowledge of digital forensic techniques, including evidence collection, recovery, preservation, chain of custody, and acquisition of forensic images, logs, and other artifacts to support investigations and remediation.
• Understanding of cyberattack stages, adversary techniques, threat profiling, host-based and network-based intrusion detection, and methods for identifying indicators of compromise.
• Experience creating and tracking incident investigations, preparing security alert notifications, maintaining accurate incident records, and documenting response activities through resolution.
• Experience supporting or advising on compliance with security frameworks and regulatory requirements, including FISMA, PCI DSS, GDPR, NIST, and ISO standards.
• Understanding of Computer Network Defense (CND) policies, procedures, standards, and applicable regulatory requirements.
• Ability to coordinate incident response teams, work with senior business leaders to understand business objectives, assess risks, and communicate effective mitigation strategies.
• Ability to clearly communicate complex cybersecurity findings, incident details, and recommended actions to technical teams, incident responders, senior executives, and non-technical stakeholders, including during crises.
• Excellent written and verbal communication, presentation, facilitation, documentation, and organizational skills, with the ability to manage multiple investigations and competing priorities simultaneously., Sitting or standing at a desk for prolonged periods of time and consistent operation of a computer. Frequent communication and exchanging of accurate information via electronic communication, phones, and in person. Occasionally lift and/or move moderate amounts of weight, typically less than 20 pounds. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions of the job.

Valiant Solutions is a security-focused IT solutions provider with public clients nationwide. Named one of the fastest growing privately held companies by Inc. 5000, Washington Technology’s Fast 50, and Washington Business Journal’s Best Places to Work in the D.C. area, Valiant Solutions prides itself on providing its employees with great benefits and career development opportunities. As a company, we are just as committed to growing careers as we are to building world-class IT solutions, all while enjoying an unparalleled work-life balance. We are in a phase of tremendous growth and building the team that will take us to the next level. We seek people whose talents and accomplishments will contribute to a thriving company, who have the character to support their capacity, and can make a positive impact on our culture. Alongside our talented team, you’ll learn to think quickly on your feet and expand your own personal and professional skill set. Our management team will inspire you to consider new perspectives and challenge you to become a better practitioner in the fast-paced industry of IT security. We hire people we respect - and we trust them to deliver results leveraging their expertise. If you would enjoy working in a dynamic environment as part of a stellar team of professionals, then we invite you to apply online today.

Benefits Snapshot (includes, but not limited to)Valiant pays 99% of the Medical, Dental, and Vision Coverage for Full-time EmployeesValiant contributes 25% towards Health Coverage for Family and Dependents100% Paid Short Term Disability and Life Insurance Policy for Full-time Employees100% Paid Certifications401K Matching up to 4%Paid Time OffPaid Federal HolidaysWellness & Fitness ProgramValiant University - Online Education and Training PortalFSA programs for: Medical Costs, Dependent Care, Transit, and ParkingReferral Bonuses, 120K-180K Annually Entry level 120K-180K Annually Entry level Cloud * Computer Vision * Information Technology * Sales * Security * Cybersecurity Research and develop agentic AI systems for cybersecurity, including LLM post-training, reinforcement learning, planning, tool calling, retrieval, memory, prompt optimization, and rigorous evaluation. Collaborate with cybersecurity experts, data scientists, and engineers to prototype state-of-the-art methods and transition successful systems toward production. Analyze agent failures, track AI advances, and define research priorities.

Remote work necessitates a high level of trust in our employees. To ensure that employee performance does not suffer in a remote work environment, all employees who telecommute are expected to have a quiet and distraction-free workspace with adequate internet, dedicate their full attention and availability to their job duties during working hours, and maintain a schedule during core business hours that align with those of their coworkers and Valiant’s clients. In alignment with Valiant’s inclusive and engaging environment, cameras are encouraged and can be required to be on during virtual video conferences. Additionally, in alignment with the Office of the Inspector General’s effort to eliminate conflicting employment, all Valiant employees are required to disclose any current or future outside employment engagements. During onboarding and throughout employment, employees must disclose any current activities or intent to engage in outside employment or other professional activities and obtain written approval. Employees may not solicit or conduct any outside business during core business hours for Valiant Solutions and our clients.