> Markdown version of [/jobs/ext/3779170-incident-commander-tier-3](https://www.wearedevelopers.com/jobs/ext/3779170-incident-commander-tier-3). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Incident Commander (Tier 3)

- **Company:** Valiant Solutions, LLC
- **Location:** United States (Remote available)
- **Experience:** Expert
- **Salary:** $145,000.0 - $220,000.0
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, Artificial Intelligence, Proxy Servers, Application Firewall, Computer Vision, Cloud Computing, Cloud Database, Cyber Security, Digital Forensics, Issue Tracking Systems, Intrusion Detection and Prevention, Intrusion Detection Systems, Information Systems Security Architecture Professional, Network Security, Log Analysis, Network Forensics, Network Administration, PCI Data Security Standards, Anti-Phishing, Security Log, Security Information and Event Management, Reinforcement Learning, Large Language Models, Prompt Engineering, Software Security, Cyber Threat Analysis, Firewalls (Computer Science), Information Technology, Cybercrime, Palo Alto Networks, Fireeye, Cortex XSOAR Platform, 3-tier Architectures, Splunk, Vulnerability Analysis
- **Published:** October 16, 2026
- **Apply:** https://www.builtincolorado.com/job/incident-commander-tier-3/11712882?handler=ApplyRedirect

## About the Role

* Minimum of 7 years of relevant professional experience, or a bachelor's degree with at least 3 years of relevant experience.
 * Must be a U.S. citizen and able to complete a federal background investigation for a High-Risk Public Trust position, including applicable credit checks.
 * Must hold CISSP certification from ISC2, plus GCIH (GIAC Certified Incident Handler) or an equivalent relevant incident response, digital forensics, or cybersecurity certification.
 * Extensive experience managing cybersecurity incidents, performing advanced incident triage, coordinating response activities, and driving investigations through resolution.
 * Demonstrated proficiency in Security Operations Center (SOC) operations, threat hunting, intrusion detection and prevention, security event monitoring, and incident detection and response.
 * Expert knowledge of TCP/IP protocols, network traffic analysis, intrusion detection and prevention systems (IDS/IPS), and security log analysis, including the ability to distinguish genuine threats from false positives.
 * Experience with endpoint security, antivirus, endpoint detection and response (EDR), host-based intrusion detection, firewalls, proxies, web application firewalls (WAF), and other enterprise security solutions, including FireEye products.
 * Extensive experience analyzing and correlating security logs from diverse systems and security devices, identifying suspicious activity, and collecting relevant host, network, and cloud data to support investigations.
 * Strong understanding of Windows and Unix/Linux operating systems, enterprise networking, system and application security, systems and network administration, and operating system hardening.
 * Knowledge of digital forensic techniques, including evidence collection, recovery, preservation, chain of custody, and acquisition of forensic images, logs, and other artifacts to support investigations and remediation.
 * Understanding of cyberattack stages, adversary techniques, threat profiling, host-based and network-based intrusion detection, and methods for identifying indicators of compromise.
 * Experience creating and tracking incident investigations, preparing security alert notifications, maintaining accurate incident records, and documenting response activities through resolution.
 * Experience supporting or advising on compliance with security frameworks and regulatory requirements, including FISMA, PCI DSS, GDPR, NIST, and ISO standards.
 * Understanding of Computer Network Defense (CND) policies, procedures, standards, and applicable regulatory requirements.
 * Ability to coordinate incident response teams, work with senior business leaders to understand business objectives, assess risks, and communicate effective mitigation strategies.
 * Ability to clearly communicate complex cybersecurity findings, incident details, and recommended actions to technical teams, incident responders, senior executives, and non-technical stakeholders, including during crises.
 * Excellent written and verbal communication, presentation, facilitation, documentation, and organizational skills, with the ability to manage multiple investigations and competing priorities simultaneously., Sitting or standing at a desk for prolonged periods of time and consistent operation of a computer. Frequent communication and exchanging of accurate information via electronic communication, phones, and in person. Occasionally lift and/or move moderate amounts of weight, typically less than 20 pounds. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions of the job.

## Description

Be an Early Applicant
Remote
Hiring Remotely in US
Senior level
Remote
Hiring Remotely in US
Senior level
Leads Tier 3 cybersecurity incident response across a 24x7x365 function. Coordinates containment, remediation, recovery, investigations, stakeholders, and communications during complex incidents such as breaches and ransomware attacks. Performs advanced triage, threat analysis, log and endpoint analysis, digital forensics coordination, incident tracking, executive reporting, and post-incident reviews. Uses Splunk, Microsoft Defender, Cortex XSOAR, and related security tools while ensuring compliance with federal requirements and cybersecurity policies.
The summary above was generated by AI, *MUST HAVE one of the following ACTIVE certifications: CISSP (Certified Information Systems Security Professional) certification from ISC2, plus GCIH (GIAC Certified Incident Handler) or an equivalent relevant incident response, digital forensics, or cybersecurity certification.

As cybersecurity incidents exceed the capabilities and scope of Tier 2 operations, the Tier 3 Incident Commander serves as the senior operational lead responsible for coordinating advanced incident response, driving resolution, and ensuring effective communication across stakeholders. The Tier 3 Incident Commander leads a 24x7x365 incident coordination function, responding to escalated alerts, notifications, and incident reports. Responsibilities include establishing and maintaining incident situational awareness, tracking incident progression, coordinating response and remediation activities, facilitating recovery efforts, communicating with stakeholders, and delivering timely, accurate incident reporting.

The role requires the ability to assess complex cybersecurity events, analyze adversary motives, capabilities, and opportunities, and determine the potential impact, scope, and severity of an incident. The Incident Commander ensures that incident reports are accurately documented in the incident tracking system, coordinates with reporting entities to validate information and establish a comprehensive understanding of the event, and identifies additional investigative, containment, remediation, or recovery actions required to achieve resolution.

The Tier 3 Incident Commander must possess extensive knowledge of cybersecurity incident response, anomaly detection and analysis, security log analysis, digital forensics, threat vectors, and adversary tactics and techniques. The individual must be able to interpret technical findings, assess incident reports, exercise sound judgment, and direct or coordinate appropriate response activities based on established procedures and incident requirements. The role also requires strict adherence to standard operating procedures (SOPs), organizational policies, and established escalation, notification, and reporting protocols, including the timely notification and communication of incidents to Federal leadership.

Required technical expertise includes a strong working knowledge of Splunk Security Information and Event Management (SIEM), Microsoft Defender Endpoint Detection and Response (EDR), Palo Alto Networks Cortex XSOAR, and supporting digital forensic and incident response tools., * Conduct advanced incident response analysis to identify attack vectors, assess threats, and investigate malware, data exposure, phishing, social engineering, and other cybersecurity incidents.

 * Coordinate incident containment, remediation, and recovery activities to mitigate threats and restore affected systems and services.
 * Monitor and analyze security events and alerts from Splunk SIEM and other security tools; review escalated alerts and perform Level 3 incident triage to determine incident type, severity, scope, risk, and appropriate response or escalation.
 * Serve as the primary point of coordination for incident management, assigning response actions and coordinating stakeholders, enterprise teams, resources, and timelines during significant incidents, including data breaches and ransomware attacks.
 * Create, maintain, and track incident records and ticket queues from initial detection through investigation, remediation, resolution, and closure, ensuring accurate documentation and compliance with federal requirements, departmental policies, and applicable legislation.
 * Evaluate and recommend technical, procedural, and physical security controls to address vulnerabilities, mitigate incident impact, reduce risk, and prevent recurrence.
 * Prepare incident status reports, executive briefings, and post-incident reports documenting findings, response actions, remediation, recovery, lessons learned, and restoration of normal operations.
 * Collaborate with digital forensic investigators and application security analysts on incident investigations and threat-hunting activities, conducting or coordinating endpoint, network, and log analysis to identify indicators of compromise, determine incident scope, and support root-cause analysis., Leads product marketing strategy for CrowdStrike's cloud risk and developer security portfolio. Owns positioning, launches, messaging, analyst engagement, field readiness, technical content, competitive strategy, thought leadership, and adoption. Partners with Product and CTO leaders to shape roadmap and market direction, creates technical proof for cloud and application security audiences, and uses customer, pipeline, usage, and competitive insights to improve business outcomes.
Top Skills: Ai TechnologiesAspmAWSCi/CdCiemCloud Vulnerability ManagementCnappContainer SecurityCspmExposure ManagementGCPImage SecurityInfrastructure As CodeKspmKubernetesAzureSoftware Composition Analysis, CrowdStrike