Job Information
SOS International LLC Cyber Incident Response Team (CIRT) Lead in Ashburn, Virginia
Ashburn, VA, USA
Full-time
Clearance Requirement: Top Secret/SCI
Company Description
Founded in 1989, SOSi is among the largest private, founder-owned technology and services integrators in the defense and government services industry. We deliver tailored solutions, tested leadership, and trusted results to enable national security missions worldwide.
Job Description
This position is contingent upon contract award
SOSi is seeking highly qualified senior professionals to support a DHS enterprise cybersecurity program providing 24/7 Security Operations Center (SOC) services. These roles deliver leadership, operational oversight, and technical expertise across cyber defense, incident response, intelligence, engineering, and modernization activities.
Job Description
Leads the end-to-end incident response function for the DHS enterprise SOC, coordinating triage, containment, eradication, and recovery; drives tool efficacy (SIEM/EDR/IDS/IPS), case management, and communications with stakeholders.
Responsibilities
Lead incident detection, analysis, escalation, and coordinated response across SOC towers.
Standardize IR runbooks, playbooks, and communications; ensure evidence handling and documentation.
Measure and improve MTTA/MTTR; track lessons learned and corrective actions.
Ensure IR alignment to DHS/CBP policy and reporting requirements.
Qualifications
Education : Bachelor’s of Science in computer engineering, computer science, IT or cyber security (or eight (8) years of relevant work experience in lieu of a degree).
Experience : 5+ years of progressively responsible experience in cyber security, information security, security engineering, network engineering with emphasis in cyber security issues and operations, computer incident response, systems architecture, or data management.
Certifications (Required): CISSP and have one or more of the following certifications: SANS GIAC Certified Intrusion Analyst (GCIA), SANS GIAC Certified Incident Handler (GCIH); SANS GIAC Certified Forensic Analyst (GCFA); SANS GIAC Certified Enterprise Defender (GCED) or other Information Assurance Technician (IAT) Level III certification in accordance with DoD 8140.
Technical Proficiency : SIEM, EDR, IPS/IDS, and case management platforms.
Clearance : TS, SCI-eligible.
Additional Information
Work Environment
Normal office conditions with potential to perform duties in various CONUS locations.
Core hours of operation are Monday through Friday, 0600 – 1700.
May be requested to work evenings and weekends to meet program and contract needs.
Working at SOSi
All interested individuals will receive consideration and will not be discriminated against for any reason.
SOSi is an equal employment opportunity employer and affirmative action employer. All interested individuals will receive consideration and will not be discriminated against on the basis of race, color, religion, sex, national origin, disability, age, sexual orientation, gender identity, genetic information, or protected veteran status. SOSi takes affirmative action in support of its policy to advance diversity and inclusion of individuals who are minorities, women, protected veterans, and individuals with disabilities.