Senior Cybersecurity Incident Response Specialist

About Bering Straits Professional Services, LLC Bering Straits Professional Services (BSPS) is committed to world-class management of global logistics, training and procurement services for U.
S. Government agencies. BSPS is certified by the U.
S. Small Business Administration (SBA) as an 8(a) contractor. In February 2022, BSPS became an International Organization for Standardization (ISO) 9001 certified company. BSPS received the ISO 9001 quality standard certification through the Performance Review Institute (PRI). About this position: Senior Cybersecurity Incident Response Specialist in Washington, DC The Essential Duties and Responsibilities are intended to present a descriptive list of the range of duties performed for this position and are not intended to reflect all duties performed within the job. Other duties may be assigned. To perform this job successfully, an individual must be able to satisfactorily perform each essential duty. The requirements listed below are representative of the knowledge, skill and/or ability required. Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions of the position. Wage/Salary Range: $100k-$120k Applicants will be notified via phone or email within ten (10) business days of submittal. Essential Duties & Responsibilities Member of the SOC team which provides 24 hours per day, 7 days per week, 365 days per year monitoring and incident response services for the organization’s Network, Systems, Applications, and Web services. Must be willing to work on site in Washington DC and work swing or overnight shifts. Provide senior level cybersecurity incident response expertise in support of the client’s Incident Response processes and procedures. Develop operational baselines such data flows and application interactions to enhance SOC’s ability to respond to incidents. Prepare and manage playbooks and relevant scenarios in addition to narratives and visual diagrams and review continuously, in compliance with NIST SP 800-61 and Government guidance. Follow current guidance from NIST 800-61, Federal Incident Notification Guidelines, CISA’s Incident Response and Vulnerability Playbook, and client guidance. Monitor system status and sensor data from deployed sensors and triage for validity from Security Information and Event Management (SIEM) System, email, texts, phone calls and all enterprise managed dashboards. Analyze all sources including network traffic, identity, fault, performance, and bandwidth information, alerts and data to augment detection of network anomalies and unauthorized activity. Meet regularly with client stakeholders to develop content, analytic rules, alerts, dashboards, automation and identify ways to improve availability and efficiency of client’s incident response program. Categorize, Prioritize, and Report on cybersecurity events in accordance with (IAW) SOPs and other relevant policies documents. Implement cybersecurity mitigations leveraging client tools and systems. Create and escalate cybersecurity-related investigations to both internal and external entities such as DHS or other Government Agencies with client and Federal defined timelines. Manage, coordinate, and respond to FOIA, audits, data calls, e-discovery and information requests. Schedule and execute incident response tabletop exercises with each client FISMA system on an annual basis. Review and handle phishing messages reported by client staff. Required (Minimum Necessary) Qualifications Education

Requirements:
High School or GED-General Educational Development-GED Diploma Bachelor’s degree in computer science or equivalent is preferred Level of Experience

Requirements:
Minimum of five years’ hands-on experience Proven experience detecting, triaging, and responding to cyber incidents across enterprise networks and cloud environments. Proficiency with SIEM, EDR/XDR platforms, and forensic tools. Strong understanding of threat actor TTPs, MITRE ATT&CK framework, and incident containment strategies. Knowledge, Skills, Abilities, and Other Characteristics Ability to analyze network traffic, logs, and endpoint telemetry to identify malicious activity. Familiarity with malware analysis, reverse engineering basics, and memory analysis concepts Experience developing and tuning detection rules, playbooks, and automated response workflows. Working knowledge of incident response frameworks (e.g., NIST SP 800-61, SANS). Understanding of vulnerability management, threat intelligence integration, and SOC metrics/reporting. Understanding of basic computer and networking technologies. Windows and Linux/Unix operating systems Networking technologies (routing, switching, VLANs, subnets, firewalls) Common networking protocols – SSH, SMB, SMTP, FTP/SFTP, HTTP/HTTPS, DNS, etc. Common enterprise technologies – Active Directory, Group Policy, and the Microsoft Azure suite of cloud services. Understanding of current system logging technology and retrieving i