​​Incident Response Deputy Team Lead ​

The U.S. Department of Homeland Security (DHS), Customs and Border Protection (CBP) Security Operations Center (SOC) is a U.S. Government program responsible to prevent, identify, contain and eradicate cyber threats to CBP networks through monitoring, intrusion detection and protective security services to CBP information systems including local area networks/wide area networks (LAN/WAN), commercial Internet connection, public facing websites, wireless, mobile/cellular, cloud, security devices, servers and workstations.  The CBP SOC is responsible for the overall security of CBP Enterprise-wide information systems, and collects, investigates, and reports any suspected and confirmed security violations. 

Leidos is seeking an experienced Incident Response professional to join our team. As a leader of this highly visible cyber Security Operations Center (SOC) for U.S. Customs and Border Protection (CBP), you will be responsible for managing day to day operations of the team, coordinating efforts of the team, leading by example and performing in-depth technical analysis of network and endpoint logs & activity, cyber incident analysis, escalating findings as deemed appropriate, and containment, remediation and root cause analysis in support of the protection of the customers’ systems, networks, and assets.    

Primary Responsibilities: 

• Responsible for assisting the CIRT Team Lead with managing the team of CIRT analysts, Incident Response actions and priorities, technical analysis and root cause analyses, and interfacing with the customer.  

• Partner with other task leads in support of customer initiatives and cyber incidents. 

• Create dashboards for key metrics and processes and deliver technical presentations to various levels of customer leadership. 

• Interface with senior DHS & CBP leaders and directors to help maintain and sustain critical systems supporting the CBP Security Operations Center. 

• Utilize state of the art technologies such as host forensics tools(FTK/Encase), Endpoint Detection & Response tools, log analysis (Splunk) and network forensics (full packet capture solution) to perform hunt and investigative activity to examine endpoint and network-based data. 

• Conduct in-depth analysis on hosts and networks, forensic analysis, log analysis, and triage in support of incident response. 

• Recognize attacker and APT activity, tactics, and procedures as indicators of compromise (IOCs) that can be used to improve monitoring, analysis, and incident response processes. 

• Develop and build security content, scripts, tools, or methods to enhance the incident investigation processes. 

• Lead incident <