Incident Commander Tier 3

Position Description

Valiant Solutions is seeking an Incident Commander (Tier 3) to join our rapidly growing team! 

Named one of the Best Places to Work in the Washington DC area for 12 consecutive years, Valiant is proud of our employee-centric culture and commitment to excellence. If you are interested in learning more about Valiant and this opportunity, we invite you to apply now!

Location: This position allows for 100% remote work. Remote work requires a high level of trust in our employees, and we strictly adhere to the details outlined in our Remote Work Policy below. 

Eligibility Requirements: U.S. Citizenship is required due to federal contract obligations, along with the ability to successfully pass a federal background investigation. Must be able to obtain and maintain a Public Trust.

*MUST HAVE one of the following ACTIVE certifications: CISSP (Certified Information Systems Security Professional) certification from ISC2, plus GCIH (GIAC Certified Incident Handler) or an equivalent relevant incident response, digital forensics, or cybersecurity certification.

As cybersecurity incidents exceed the capabilities and scope of Tier 2 operations, the Tier 3 Incident Commander serves as the senior operational lead responsible for coordinating advanced incident response, driving resolution, and ensuring effective communication across stakeholders. The Tier 3 Incident Commander leads a 24x7x365 incident coordination function, responding to escalated alerts, notifications, and incident reports. Responsibilities include establishing and maintaining incident situational awareness, tracking incident progression, coordinating response and remediation activities, facilitating recovery efforts, communicating with stakeholders, and delivering timely, accurate incident reporting.

The role requires the ability to assess complex cybersecurity events, analyze adversary motives, capabilities, and opportunities, and determine the potential impact, scope, and severity of an incident. The Incident Commander ensures that incident reports are accurately documented in the incident tracking system, coordinates with reporting entities to validate information and establish a comprehensive understanding of the event, and identifies additional investigative, containment, remediation, or recovery actions required to achieve resolution.

The Tier 3 Incident Commander must possess extensive knowledge of cybersecurity incident response, anomaly detection and analysis, security log analysis, digital forensics, threat vectors, and adversary tactics and techniques. The individual must be able to interpret technical findings, assess incident reports, exercise sound judgment, and direct or coordinate appropriate response activities based on established procedures and incident requirements. The role also requires strict adherence to standard operating procedures (SOPs), organizational policies, and established escalation, notification, and reporting protocols, including the timely notification and communication of incidents to Federal leadership.

Required technical expertise includes a strong working knowledge of Splunk Security Information and Event Management (SIEM), Microsoft Defender Endpoint Detection and Response (EDR), Palo Alto Networks Cortex XSOAR, and supporting digital forensic and incident response tools.

Required Experience:

• Minimum of 7 years of relevant professional experience, or a bachelor’s degree with at least 3 years of relevant experience.
• Must be a U.S. citizen and able to complete a federal background investigation for a High-Risk Public Trust position, including applicable credit checks.
• Must hold CISSP certification from ISC2, plus GCIH (GIAC Certified Incident Handler) or an equivalent relevant incident response, digital forensics, or cybersecurity certification.
• Extensive experience managing cybersecurity incidents, performing advanced incident triage, coordinating response activities, and driving investigations through resolution.
• Demonstrated proficiency in Security Operations Center (SOC) operations, threat hunting, intrusion detection and prevention, security event monitoring, and incident detection and response.
• Expert knowledge of TCP/IP protocols, network traffic analysis, intrusion detection and prevention systems (IDS/IPS), and security log analysis, including the ability to distinguish genuine threats from false positives.
• Experience with endpoint security, antivirus, endpoint detection and response (EDR), host-based intrusion detection, firewalls, proxies, web application firewalls (WAF), and other enterprise security solutions, including FireEye products.
• Extensive experience analyzing and correlating security logs from diverse systems and security devices, identifying suspicious activity, and collecting relevant host, network, and cloud data to support investigations.
• Strong understanding of Windows and Unix/Linux operating systems, enterprise networking, system and application security, systems and network administration, and operating system hardening.
• Knowledge of digital forensic techniques, including evidence collection, recovery, preservation, chain of custody, and acquisition of forensic images, logs, and other artifacts to support investigations and remediation.
• Understanding of cyberattack stages, adversary techniques, threat profiling, host-based and network-based intrusion detection, and methods for identifying indicators of compromise.
• Experience creating and tracking incident investigations, preparing security alert notifications, maintaining accurate incident records, and documenting response activities through resolution.
• Experience supporting or advising on compliance with security frameworks and regulatory requirements, including FISMA, PCI DSS, GDPR, NIST, and ISO standards.
• Understanding of Computer Network Defense (CND) policies, procedures, standards, and applicable regulatory requirements.
• Ability to coordinate incident response teams, work with senior business leaders to understand business objectives, assess risks, and communicate effective mitigation strategies.
• Ability to clearly communicate complex cybersecurity findings, incident details, and recommended actions to technical teams, incident responders, senior executives, and non-technical stakeholders, including during crises.
• Excellent written and verbal communication, presentation, facilitation, documentation, and organizational skills, with the ability to manage multiple investigations and competing priorities simultaneously.

Responsibilities:

• Conduct advanced incident response analysis to identify attack vectors, assess threats, and investigate malware, data exposure, phishing, social engineering, and other cybersecurity incidents.
• Coordinate incident containment, remediation, and recovery activities to mitigate threats and restore affected systems and services.
• Monitor and analyze security events and alerts from Splunk SIEM and other security tools; review escalated alerts and perform Level 3 incident triage to determine incident type, severity, scope, risk, and appropriate response or escalation.
• Serve as the primary point of coordination for incident management, assigning response actions and coordinating stakeholders, enterprise teams, resources, and timelines during significant incidents, including data breaches and ransomware attacks.
• Create, maintain, and track incident records and ticket queues from initial detection through investigation, remediation, resolution, and closure, ensuring accurate documentation and compliance with federal requirements, departmental policies, and applicable legislation.
• Evaluate and recommend technical, procedural, and physical security controls to address vulnerabilities, mitigate incident impact, reduce risk, and prevent recurrence.
• Prepare incident status reports, executive briefings, and post-incident reports documenting findings, response actions, remediation, recovery, lessons learned, and restoration of normal operations.
• Collaborate with digital forensic investigators and application security analysts on incident investigations and threat-hunting activities, conducting or coordinating endpoint, network, and log analysis to identify indicators of compromise, determine incident scope, and support root-cause analysis.

About Valiant Solutions

Valiant Solutions delivers cybersecurity and IT services to federal civilian, defense, and national security customers nationwide. We support the full cyber lifecycle, from secure system design and accreditation through AI-enabled operations, threat emulation, and continuous improvement, across classified and unclassified environments. Our work is independently certified for quality and security, including CMMI, CMMC, and ISO certifications.

Valiant is a multi-year Washington Business Journal Best Places to Work winner, and our growth and cyber leadership have been recognized by Washington Technology, Northern Virginia Technology Council, and the Triangle Business Journal. We offer strong benefits, rewards for earning industry certifications, and room to grow your career as we grow. Headquartered in McLean, Virginia, our distributed workforce supports customers from coast to coast. We go where the stakes are highest, and the margin for error is zero. If you want meaningful work alongside talented professionals, apply today.

Benefits Snapshot

Valiant takes care of the people who support our customers, with real choices in coverage and real investment in your career. Eligible full-time employees receive:

• A choice of medical plans, from an affordable HSA option to a full-featured PPO, with generous company contributions
• Dental and vision coverage for you and your family
• Company-paid life, short-term disability, and long-term disability insurance
• Optional supplemental life, accident, and critical illness coverage to round out your protection
• 401(k) retirement plan with company match
• Paid time off that grows with your years of service, plus paid federal holidays
• Paid certifications, professional development, and the Valiant University training portal
• Flexible spending accounts and a wellness and fitness program
• Referral bonuses when you help us bring great people to Valiant

Benefit eligibility and plan details are subject to the terms of each plan and may change from time to time.

Remote Work Policy (Remote and Hybrid Positions Only)

Remote work necessitates a high level of trust in our employees. To ensure that employee performance does not suffer in a remote work environment, all employees who telecommute are expected to have a quiet and distraction-free workspace with adequate internet, dedicate their full attention and availability to their job duties during working hours, and maintain a schedule during core business hours that aligns with those of their coworkers and Valiant's clients. In alignment with Valiant's inclusive and engaging environment, cameras are encouraged and can be required to be on during virtual video conferences. Additionally, in alignment with the Office of the Inspector General’s effort to eliminate conflicting employment, all Valiant employees are required to disclose any current or future outside employment engagements. During onboarding and throughout employment, employees must disclose any current activities or intent to engage in outside employment or other professional activities and obtain written approval.  Employees may not solicit or conduct any outside business during core business hours for Valiant Solutions and our clients.

Equal Employment Opportunity

Valiant Solutions is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex (including pregnancy), national origin, age, disability, genetic information, marital status, protected veteran status, or any other characteristic protected by federal, state, or local law. Valiant Solutions provides reasonable accommodations to qualified individuals with disabilities. If you need an accommodation during the application or hiring process, please contact [email protected].

Physical Demands

Sitting or standing at a desk for prolonged periods and consistently operating a computer. Frequent communication and exchanging of accurate information via electronic communication, phones, and in person. Occasionally lift and/or move moderate amounts of weight, typically less than 20 pounds. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions of the job.

Authorization to Share Resume and Personal Information

By submitting your resume for this position, you authorize Valiant Solutions to share your resume, as well as personal information included on the resume, with its subsidiaries, affiliates, and teaming partners for the purpose of considering you for this position and other available positions requiring comparable skills, education, and experience. Should Valiant Solutions or its affiliates and teaming partners wish to initiate pre-employment discussions, you will be asked to complete an employment application and related employment documents.