Remediation and Mitigation Lead, Top Secret

Type of Requisition:

Regular

Clearance Level Must Currently Possess:

Top Secret

Clearance Level Must Be Able to Obtain:

Top Secret

Public Trust/Other Required:

None

Job Family:

Cyber and IT Risk Management

Job Qualifications:

Skills:

Remediation Management, Remediation Plans, Security Risk Mitigation, Team Leadership, Threat Mitigation

Certifications:

None

Experience:

10 + years of related experience

US Citizenship Required:

Yes

Job Description:

The Remediation and Mitigation (R&M) Lead oversees teams that plan, manage, and execute remediation actions across affected organizations, delivering actionable, technically grounded guidance that accelerates incident recovery and strengthens long‑term resilience for federal, state, local, tribal, territorial (SLTT), and critical infrastructure stakeholders. The role directs the full remediation lifecycle from incident‑specific plan development through completion ensuring cohesive communication, accurate reporting, and mission‑aligned knowledge capture that enhances national cybersecurity resilience.

In collaboration with internal and external stakeholders, the R&M Lead ensures high‑quality tools, guides, and countermeasures are produced from real‑world engagements and lessons learned, advancing consistent, risk‑reducing remediation across the ecosystem.

Key Responsibilities

Remediation Coordination Leadership

• Oversee teams that serve as the central coordination function for planning, managing, and executing incident remediation across networks, endpoints, and security controls.
• Ensure teams provide timely, accurate reporting of incident response actions to leadership and stakeholders.
• Oversee teams that deliver complete operational metrics, statistics, and analytic insights.
• Ensure responsible, secure, mission‑aligned information sharing and high‑quality content contributions to engagement reports, defensive measures, and threat‑informed prevention materials.
• Lead knowledge capture from real‑world incidents, enforcing R&M and Threat Hunt (TH) guidance and feeding insights into processes and knowledgebases to enhance national remediation capability.
• Oversee teams preparing regular and ad‑hoc briefings to mission teams, leadership, and stakeholders to maintain situational awareness and coordinated operational response.

Countermeasures Analysis Oversight

• Direct teams that evaluate threat actor activity and stakeholder environments to recommend optimal containment and eradication actions, reducing risk of re‑compromise and regaining control of compromised assets.
• Ensure actionable technical guidance is provided across networks, endpoints, and security controls.
• Oversee creation of high‑quality reports documenting findings, mitigation strategies, and technical insights.
• Maintain adherence to established R&M and TH knowledge‑management procedures.

Countermeasures Research & Tool Sustainment

• Oversee researchers who test, validate, and document countermeasures to keep CISA’s mitigation guidance ahead of adversary actions, adding insights from past engagements into catalogs and documentation.
• Ensure the countermeasures database remains accurate, relevant, and complete by integrating cyber threat intelligence (CTI) and all‑source reporting on adversary techniques, tactics and procedures (TTPs) and updating content to reflect current threat landscapes.
• Enforce secure, mission‑aligned information sharing and contribute expert input to defensive measures, threat‑informed prevention content, and other publications.

Deception Operations (DecOps) Support

• Oversee DecOps teams operationalizing the MITRE Engage™ framework to conduct deception activities as needed during cyber incidents, providing overwatch during containment and eradication.
• Ensure accurate operational metrics and statistical reporting that strengthen performance oversight, situational awareness, and leadership decision‑making.
• Maintain secure, accurate information sharing with stakeholders to support coordinated response and remediation.

Operational Governance, Reporting & Knowledge Management

• Oversee responsible information sharing practices and contribute high‑quality, mission‑aligned content to reports, tools, and prevention materials.
• Ensure teams consistently capture lessons learned and maintain organizational knowledge quality in accordance with R&M and TH guidance,
<