{"id":2663206,"url":"https://alion.io/job/valiant-solutions-incident-commander-tier-3","title":"Incident Commander (Tier 3)","company":{"id":3886861,"name":"Valiant Solutions","domain":"valiantsolutions.com","url":"https://alion.io/company/valiant-solutions","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"iCIMS","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":106000,"max_usd":188000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":340},"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Anomaly Detection","optional":false},{"name":"Commander.js","optional":false},{"name":"Cortex","optional":false},{"name":"Cortex XSOAR","optional":false},{"name":"GDPR","optional":false},{"name":"Incident Management","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"PCI DSS","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"TCP/IP","optional":false},{"name":"Unix","optional":false},{"name":"Windows","optional":false},{"name":"JavaScript","optional":true},{"name":"Node JS","optional":true},{"name":"Prometheus","optional":true}],"status":"live","first_seen_at":"2026-10-16T01:31:14Z","employer_posted_date":"2026-10-16","last_verified_at":"2026-10-19T13:31:10Z","board_verified":true,"closed_at":null,"days_open":3,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":3},"description":"Position Description\nValiant Solutions is seeking an Incident Commander (Tier 3) to join our rapidly growing team!\nNamed one of theBest Places to Work in the Washington DC area for 12 consecutive years, Valiant is proud of our employee-centric culture and commitment to excellence. If you are interested in learning more about Valiant and this opportunity, we invite you to apply now!\nThis position allows for 100% remote work. Remote work requires a high level of trust in our employees, and we strictly adhere to the details outlined in our Remote Work Policy below.\n*MUST HAVE one of the following ACTIVE certifications: CISSP (Certified Information Systems Security Professional) certification from ISC2, plus GCIH (GIAC Certified Incident Handler) or an equivalent relevant incident response, digital forensics, or cybersecurity certification.\nAs cybersecurity incidents exceed the capabilities and scope of Tier 2 operations, the Tier 3 Incident Commander serves as the senior operational lead responsible for coordinating advanced incident response, driving resolution, and ensuring effective communication across stakeholders. The Tier 3 Incident Commander leads a 24x7x365 incident coordination function, responding to escalated alerts, notifications, and incident reports. Responsibilities include establishing and maintaining incident situational awareness, tracking incident progression, coordinating response and remediation activities, facilitating recovery efforts, communicating with stakeholders, and delivering timely, accurate incident reporting.\nThe role requires the ability to assess complex cybersecurity events, analyze adversary motives, capabilities, and opportunities, and determine the potential impact, scope, and severity of an incident. The Incident Commander ensures that incident reports are accurately documented in the incident tracking system, coordinates with reporting entities to validate information and establish a comprehensive understanding of the event, and identifies additional investigative, containment, remediation, or recovery actions required to achieve resolution.\nThe Tier 3 Incident Commander must possess extensive knowledge of cybersecurity incident response, anomaly detection and analysis, security log analysis, digital forensics, threat vectors, and adversary tactics and techniques. The individual must be able to interpret technical findings, assess incident reports, exercise sound judgment, and direct or coordinate appropriate response activities based on established procedures and incident requirements. The role also requires strict adherence to standard operating procedures (SOPs), organizational policies, and established escalation, notification, and reporting protocols, including the timely notification and communication of incidents to Federal leadership.\nRequired technical expertise includes a strong working knowledge of Splunk Security Information and Event Management (SIEM), Microsoft Defender Endpoint Detection and Response (EDR), Palo Alto Networks Cortex XSOAR, and supporting digital forensic and incident response tools.\nRequired Experience:\nMinimum of 7 years of relevant professional experience, or a bachelor’s degree with at least 3 years of relevant experience.\nMust be a U.S. citizen and able to complete a federal background investigation for a High-Risk Public Trust position, including applicable credit checks.\nMust hold CISSP certification from ISC2, plus GCIH (GIAC Certified Incident Handler) or an equivalent relevant incident response, digital forensics, or cybersecurity certification.\nExtensive experience managing cybersecurity incidents, performing advanced incident triage, coordinating response activities, and driving investigations through resolution.\nDemonstrated proficiency in Security Operations Center (SOC) operations, threat hunting, intrusion detection and prevention, security event monitoring, and incident detection and response.\nExpert knowledge of TCP/IP protocols, network traffic analysis, intrusion detection and prevention systems (IDS/IPS), and security log analysis, including the ability to distinguish genuine threats from false positives.\nExperience with endpoint security, antivirus, endpoint detection and response (EDR), host-based intrusion detection, firewalls, proxies, web application firewalls (WAF), and other enterprise security solutions, including FireEye products.\nExtensive experience analyzing and correlating security logs from diverse systems and security devices, identifying suspicious activity, and collecting relevant host, network, and cloud data to support investigations.\nStrong understanding of Windows and Unix/Linux operating systems, enterprise networking, system and application security, systems and network administration, and operating system hardening.\nKnowledge of digital forensic techniques, including evidence collection, recovery, preservation, chain of custody, and acquisition of forensic images, logs, and other artifacts to support investigations and remediation.\nUnderstanding of cyberattack stages, adversary techniques, threat profiling, host-based and network-based intrusion detection, and methods for identifying indicators of compromise.\nExperience creating and tracking incident investigations, preparing security alert notifications, maintaining accurate incident records, and documenting response activities through resolution.\nExperience supporting or advising on compliance with security frameworks and regulatory requirements, including FISMA, PCI DSS, GDPR, NIST, and ISO standards.\nUnderstanding of Computer Network Defense (CND) policies, procedures, standards, and applicable regulatory requirements.\nAbility to coordinate incident response teams, work with senior business leaders to understand business objectives, assess risks, and communicate effective mitigation strategies.\nAbility to clearly communicate complex cybersecurity findings, incident details, and recommended actions to technical teams, incident responders, senior executives, and non-technical stakeholders, including during crises.\nExcellent written and verbal communication, presentation, facilitation, documentation, and organizational skills, with the ability to manage multiple investigations and competing priorities simultaneously.\nResponsibilities:\nConduct advanced incident response analysis to identify attack vectors, assess threats, and investigate malware, data exposure, phishing, social engineering, and other cybersecurity incidents.\nCoordinate incident containment, remediation, and recovery activities to mitigate threats and restore affected systems and services.\nMonitor and analyze security events and alerts from Splunk SIEM and other security tools; review escalated alerts and perform Level 3 incident triage to determine incident type, severity, scope, risk, and appropriate response or escalation.\nServe as the primary point of coordination for incident management, assigning response actions and coordinating stakeholders, enterprise teams, resources, and timelines during significant incidents, including data breaches and ransomware attacks.\nCreate, maintain, and track incident records and ticket queues from initial detection through investigation, remediation, resolution, and closure, ensuring accurate documentation and compliance with federal requirements, departmental policies, and applicable legislation.\nEvaluate and recommend technical, procedural, and physical security controls to address vulnerabilities, mitigate incident impact, reduce risk, and prevent recurrence.\nPrepare incident status reports, executive briefings, and post-incident reports documenting findings, response actions, remediation, recovery, lessons learned, and restoration of normal operations.\nCollaborate with digital forensic investigators and application security analysts on incident investigations and threat-hunting activities, conducting or coordinating endpoint, network, and log analysis to identify indicators of compromise, determine incident scope, and support root-cause analysis.\nAbout Valiant Solutions\nValiant Solutions is a security-focused IT solutions provider with public clients nationwide. Named one of the fastest growing privately held companies by Inc. 5000, Washington Technology’s Fast 50, and Washington Business Journal’s Best Places to Work in the D.C. area, Valiant Solutions prides itself on providing its employees with great benefits and career development opportunities. As a company, we are just as committed to growing careers as we are to building world-class IT solutions, all while enjoying an unparalleled work-life balance. We are in a phase of tremendous growth and building the team that will take us to the next level. We seek people whose talents and accomplishments will contribute to a thriving company, who have the character to support their capacity, and can make a positive impact on our culture. Alongside our talented team, you’ll learn to think quickly on your feet and expand your own personal and professional skill set. Our management team will inspire you to consider new perspectives and challenge you to become a better practitioner in the fast-paced industry of IT security. We hire people we respect - and we trust them to deliver results leveraging their expertise. If you would enjoy working in a dynamic environment as part of a stellar team of professionals, then we invite you to apply online today.\nBenefits Snapshot (includes, but not limited to) Valiant pays 99% of the Medical, Dental, and Vision Coverage for Full-time EmployeesValiant contributes 25% towards Health Coverage for Family and Dependents100% Paid Short Term Disability and Life Insurance Policy for Full-time Employees100% Paid Certifications401K Matching up to 4%Paid Time OffPaid Federal HolidaysWellness & Fitness ProgramValiant University - Online Education and Training PortalFSA programs for: Medical Costs, Dependent Care, Transit, and ParkingReferral Bonuses\nRemote Work Policy\nRemote work necessitates a high level of trust in our employees. To ensure that employee performance does not suffer in a remote work environment, all employees who telecommute are expected to have a quiet and distraction-free workspace with adequate internet, dedicate their full attention and availability to their job duties during working hours, and maintain a schedule during core business hours that align with those of their coworkers and Valiant's clients. In alignment with Valiant's inclusive and engaging environment, cameras are encouraged and can be required to be on during virtual video conferences. Additionally, in alignment with the Office of the Inspector General’s effort to eliminate conflicting employment, all Valiant employees are required to disclose any current or future outside employment engagements. During onboarding and throughout employment, employees must disclose any current activities or intent to engage in outside employment or other professional activities and obtain written approval. Employees may not solicit or conduct any outside business during core business hours for Valiant Solutions and our clients.\nEqual Employment Opportunity\nValiant Solutions is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, disability, genetic information, marital status, or veteran status, in accordance with applicable law.\nPhysical Demands\nSitting or standing at a desk for prolonged periods of time and consistent operation of a computer. Frequent communication and exchanging of accurate information via electronic communication, phones, and in person. Occasionally lift and/or move moderate amounts of weight, typically less than 20 pounds. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions of the job.\nAuthorization to Share Resume and Personal Information\nBy submitting your resume for t...","description_format":"text","description_chars":12516,"description_truncated":true,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":["Life insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Government","Information Security","Incident Response"],"lifecycle":[{"event":"open","at":"2026-10-16T01:31:14Z"}],"visa":[],"liveness":{"score":51,"band":"ok","label":"Likely open","p_open":1,"p_active":0.879,"p_room":0.578,"age_days":3,"expected_fill_days":3,"reasons":["conf:0","velocity","win:tail"],"computed_at":"2026-10-19T05:45:15Z"},"pay":null,"html_url":"https://alion.io/job/valiant-solutions-incident-commander-tier-3","json_url":"https://alion.io/job/valiant-solutions-incident-commander-tier-3.json","meta":{"generated_at":"2026-10-19T15:49:50Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11889,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-20T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3886861},"rest":"https://alion.io/mcp/rest/get_company?id=3886861"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fvaliant-solutions-incident-commander-tier-3"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fvaliant-solutions-incident-commander-tier-3"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fvaliant-solutions-incident-commander-tier-3"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/valiant-solutions-incident-commander-tier-3\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fvaliant-solutions-incident-commander-tier-3"}]}