Incident Response Lead

Parsons is looking for an experienced Incident Response Lead to guide a team performing high-impact cyber investigations and analysis in support of critical mission objectives.

This role offers the opportunity to combine deep incident response expertise with leadership, mentorship, and continuous improvement in an environment where technical excellence and mission success go hand in hand.

In this role, you will lead a team responsible for conducting incident response activities, including host-based and network-based forensic analysis, identifying indicators of compromise, and correlating findings across multiple data sources to detect, investigate, and understand Advanced Persistent Threat (APT) activity. You will help ensure the team applies sound investigative tradecraft, maintains high technical standards, and evolves its methods as new tools, technologies, and threats emerge. Your leadership will directly support mission success by strengthening the team’s ability to identify and respond to sophisticated cyber threats.

This position is ideal for someone who combines deep incident response expertise with strong leadership and mentoring capability.

You will work closely with a highly technical team, providing day-to-day leadership, mentorship, and support while helping team members strengthen their skills and advance their careers.

You’ll also play an important role in improving processes, refining investigative workflows, and driving technical excellence across the team.

You’ll be joining Parsons’ local Analytics & Engineering team, a community known for its strong culture of defensive cyber operations, technical excellence, and collaboration.

We invest in both mission success and team connection through regular social events, technical talks, training opportunities, and hands-on innovation activities at our Cybersecurity Center of Excellence Lab in Columbia, MD.

From team lunches and ice cream socials to family-friendly seasonal events and technical learning sessions, we work hard to create an environment where people can do meaningful work and enjoy being part of the team.

• Lead a team performing advanced incident response and cyber analysis in support of customer mission requirements
• Oversee investigations involving host-based and network-based forensic analysis
• Correlate data from multiple sources to identify, analyze, and track malicious activity, including APT behaviors and indicators
• Guide investigative efforts to determine scope, impact, root cause, and recommended response actions
• Ensure the team produces clear, accurate, and actionable reporting on findings and incident activity
• Promote incident response best practices, technical rigor, and continuous improvement across workflows and processes
• Evaluate and adopt emerging tools, technologies, and methodologies that improve incident response effectiveness
• Mentor analysts and support their technical development and career growth
• Collaborate with internal technical teams and stakeholders to strengthen mission outcomes and operational performance

• Active TS/SCI clearance
• GCIH or equivalent incident response certification
• Bachelors degree and 8+ years experience
• 8+ years of hands-on experience in Digital Forensics and Incident Response (DFIR), with at least 5 years focused on network intrusion analysis, malware forensics, and memory analysis
• 3+ years in a leadership or supervisory role, responsible for leading intrusion investigations, managing incident responders, and briefing technical findings to leadership
• Demonstrated experience within the last three years analyzing advanced persistent threat (APT) activity and correlating findings from multiple data sources (e.g., host forensics, network logs, and threat intelligence)
• Strong understanding of cyber threat investigation, incident handling, and analytic tradecraft
• Ability to lead technical teams in a fast-paced cybersecurity environment
• Strong written and verbal communication skills

• Experience leading incident response teams supporting Government or national security missions
• Familiarity with threat hunting, malware analysis, digital forensics, and adversary tracking
• Experience correlating data across endpoint, network, log, and forensic sources
• Proven ability to improve incident response processes, technical quality, and team performance
• Passion for mentoring and developing highly technical cybersecurity professionals

Parsons is aware of fraudulent recruitment practices.

To learn more about recruitment fraud and how to report it, please refer to https://www.parsons.com/fraudulent-recruitment/.