The Role
Lead 24x7 SOC operations and incident response including detection, triage, forensic analysis, containment, eradication, recovery, malware analysis, threat hunting, and CTI. Ensure incident reporting and evidence handling per NIST SP 800-86, coordinate with NIH leadership, configure SOC tools, run tabletop exercises, and produce forensic activity metrics and after-action reports.
Summary Generated by Built In
Company Overview
Development InfoStructure LLC., (Devis) is a leading provider of innovative software development, management, and consulting services, specializing in cutting-edge technologies such as DevSecOps, AI, and Machine Learning. With over 30 years of experience, we have established ourselves as a trusted partner for government agencies, delivering tailored, mission-critical solutions that drive digital transformation and operational excellence. Our client-centric approach, coupled with our deep domain expertise and technical prowess, enables us to forge enduring relationships and consistently deliver high-impact, adaptive solutions that resonate with the unique needs of the public sector.
Job Overview
The SOC / Incident Response Lead serves as the operational leader for 24x7x365 security monitoring and incident response under the Information Security Program Support Services (ISPSS) effort supporting the NIH Office of the Director, Office of Information Technology (OD OIT), responsible for leading Tier 1 detection and triage and Tier 2/3 forensics, threat hunting, and cyber threat intelligence across the NIH/OD-OIT managed environment. This role drives execution across incident detection, triage, investigation of suspected intrusions within 30 minutes, containment and recovery, digital forensics (NIST SP 800-86), malware analysis, and incident reporting in close coordination with NIH/OD OIT leadership and enterprise cybersecurity organizations.
This is a full-time position with work performed primarily offsite, though travel to NIH/OD facilities in the Bethesda, MD area will be required on an as-needed basis. Core hours are Monday-Friday, 7:00 AM - 6:00 PM EST, and after-hours support for emergency incidents will be required as needed by NIH/OD. Position is contingent upon award and client approval.
Primary Duties
Lead 24x7 Security OperationsPreferred Qualifications
Clearance
Salary Range
Development InfoStructure LLC., (Devis) is a leading provider of innovative software development, management, and consulting services, specializing in cutting-edge technologies such as DevSecOps, AI, and Machine Learning. With over 30 years of experience, we have established ourselves as a trusted partner for government agencies, delivering tailored, mission-critical solutions that drive digital transformation and operational excellence. Our client-centric approach, coupled with our deep domain expertise and technical prowess, enables us to forge enduring relationships and consistently deliver high-impact, adaptive solutions that resonate with the unique needs of the public sector.
Job Overview
The SOC / Incident Response Lead serves as the operational leader for 24x7x365 security monitoring and incident response under the Information Security Program Support Services (ISPSS) effort supporting the NIH Office of the Director, Office of Information Technology (OD OIT), responsible for leading Tier 1 detection and triage and Tier 2/3 forensics, threat hunting, and cyber threat intelligence across the NIH/OD-OIT managed environment. This role drives execution across incident detection, triage, investigation of suspected intrusions within 30 minutes, containment and recovery, digital forensics (NIST SP 800-86), malware analysis, and incident reporting in close coordination with NIH/OD OIT leadership and enterprise cybersecurity organizations.
This is a full-time position with work performed primarily offsite, though travel to NIH/OD facilities in the Bethesda, MD area will be required on an as-needed basis. Core hours are Monday-Friday, 7:00 AM - 6:00 PM EST, and after-hours support for emergency incidents will be required as needed by NIH/OD. Position is contingent upon award and client approval.
Primary Duties
Lead 24x7 Security Operations
- Direct real-time, 24x7x365 security log collection, monitoring, alerting, and event analysis across the OIT-managed environment
- Perform incident triage on all incidents to determine scope, urgency, and operational impact
- Investigate suspected intrusions and suspicious activity within 30 minutes of detection
- Ensure accurate, consistent incident categorization and ticketing
- Lead detection, triage, analysis, containment, eradication, recovery, and post-incident reporting
- Oversee Tier 2/3 digital forensics, evidence preservation, and chain of custody compliant with NIST SP 800-86
- Conduct malware analysis, reverse engineering, and analysis of suspicious websites, emails, and payloads
- Deliver Security Incident Tickets/Reports within 1 hour of detection and Incident Response After Action Reports
- Lead Advanced Persistent Threat (APT) hunting across the managed environment
- Operate an active Cyber Threat Intelligence (CTI) program to collect, correlate, and disseminate relevant intelligence and IOCs
- Support collaboration with OCIO threat intelligence / Fusion Center activities
- Provide engineering support to the SOC and Incident Response Team and ensure proper configuration of SOC-managed tools and agents
- Lead annual incident response tabletop exercises and implement lessons learned
- Produce the Monthly Forensic Activity Summary and related metrics
Required Qualifications
Education & Experience
- Bachelor’s degree in Computer Science, Cybersecurity, Information Systems, or a related field (or equivalent experience)
- Minimum 7 years in security operations / incident response, including SOC team leadership
- Demonstrated experience with digital forensics, malware analysis, and threat hunting in enterprise environments
- One or more incident response/forensics certifications: GCIH, GCIA, or GCFA (or comparable)
- CISSP strongly preferred
- Hands-on expertise with SIEM, EDR, and IDS/IPS platforms and security log analysis
- Forensic tooling and evidence handling consistent with NIST SP 800-86 and Federal Rules of Evidence
- Familiarity with US-CERT incident notification guidelines and federal reporting timelines
- Calm, decisive leadership during active incidents and crisis coordination
- Strong written reporting and clear escalation communication
- Experience supporting NIH/HHS or other federal SOC operations
- Cloud monitoring/IR experience (e.g., Azure, AWS)
- Experience standing up or maturing CTI programs
Clearance
- Must be able to obtain and maintain the NIH/OD/OIT required clearance level and complete all suitability/onboarding requirements
Salary Range
- $110,000 - $130,000
Skills Required
- Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or equivalent experience
- Minimum 7 years in security operations / incident response, including SOC team leadership
- Experience with digital forensics, malware analysis, and threat hunting in enterprise environments
- Incident response/forensics certification (GCIH, GCIA, GCFA, or comparable)
- CISSP certification
- Hands-on expertise with SIEM, EDR, and IDS/IPS platforms and security log analysis
- Forensic tooling and evidence handling consistent with NIST SP 800-86 and Federal Rules of Evidence
- Familiarity with US-CERT incident notification guidelines and federal reporting timelines
- Calm, decisive leadership during active incidents and strong written reporting and escalation communication
- Ability to obtain and maintain the NIH/OD/OIT required clearance and complete suitability/onboarding requirements
- Cloud monitoring/incident response experience (Azure, AWS)
- Experience supporting NIH/HHS or other federal SOC operations
- Malware reverse engineering and advanced malware analysis
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Development InfoStructure, LLC. (Devis) is a leading provider of IT consulting services and solutions to the Federal, State and Local Governments, as well as the international development community. Devis helps maximize your return on IT investment by: 1) working with the best-adapted programming languages, databases and other solutions for your specific project; 2) actively supporting the open source community; and 3) using and promoting open technology standards. Devis has extensive experience with world wide software deployments and support. Our systems operate in more than 80 countries, and in every federal department. Devis-built systems involve the full vertical spectrum of users from data entry clerks to Governement managers to Congress
