Job Openings

ICS Nett, Inc is hiring a Cyber Incident Responder to join our dynamic team day shift. This is a hybrid position with 2-3 days onsite every week in Hanover, MD

The candidate will provide as a front-line defender, detecting, triaging, containing, and eradicating cyber threats across our enterprise infrastructure. This role is critical for minimizing the impact of security incidents, coordinating response actions, and preserving forensic evidence in support of Department of Defense (DoD) missions.

The Cyber Incident Responder will play an important role responsible for executing the full incident response lifecycle during swing-shift, weekend, and holiday coverage windows. This position focuses on detecting and responding to security incidents in real time, performing containment and eradication actions, and coordinating recovery efforts using enterprise tools such as SIEM, SOAR, CrowdStrike, CyberArk, and Endpoint Security Suite (ESS).

The Incident Responder will collaborate with cross-functional IT and security teams to:

• Execute incident response procedures in accordance with NIST SP 800-61 and DoD guidelines
• Coordinate with JFHQ-DODIN on cyber incident reporting and remediation
• Support insider threat response and investigations
• Contain and remediate compromised systems, accounts, and endpoints
• Preserve and document forensic evidence for incident case management
• Maintain incident response playbooks and ensure high operational readiness during all covered hours

ICS Nett, Inc is hiring a Cyber Incident Responder to join our dynamic team this is day shift with 4x 10 hours to provide support. This is an on-site position at Quantico, VA

The candidate will provide as a front-line defender, detecting, triaging, containing, and eradicating cyber threats across our enterprise infrastructure. This role is critical for minimizing the impact of security incidents, coordinating response actions, and preserving forensic evidence in support of Department of Defense (DoD) missions.

The Cyber Incident Responder will play an important role responsible for executing the full incident response lifecycle during swing-shift, weekend, and holiday coverage windows. This position focuses on detecting and responding to security incidents in real time, performing containment and eradication actions, and coordinating recovery efforts using enterprise tools such as SIEM, SOAR, CrowdStrike, CyberArk, and Endpoint Security Suite (ESS).

The Incident Responder will collaborate with cross-functional IT and security teams to:

• Execute incident response procedures in accordance with NIST SP 800-61 and DoD guidelines
• Coordinate with JFHQ-DODIN on cyber incident reporting and remediation
• Support insider threat response and investigations
• Contain and remediate compromised systems, accounts, and endpoints
• Preserve and document forensic evidence for incident case management
• Maintain incident response playbooks and ensure high operational readiness during all covered hours

ICS Nett, Inc is hiring a highly skilled and experienced Senior ACAS (Assured Compliance Assessment Solution) Engineer to join our dynamic team. The successful candidate will be responsible for the implementation, maintenance, and optimization of our ACAS infrastructure. This role is critical for ensuring the security and compliance of our information systems with DoD and other federal regulations. The ideal candidate will have a strong background in cybersecurity, vulnerability management, and network security. This position will support our Defense Counterintelligence Security Agency (DCSA) program based out of Quantico VA.

The Assured Compliance Assessment Solution (ACAS) Engineer is a critical role responsible for the implementation, maintenance, and operational support of the ACAS suite of tools within the organization. This position focuses on ensuring continuous vulnerability scanning, configuration compliance assessments, and reporting capabilities to maintain a strong security posture and adherence to relevant security policies and regulations (e.g., NIST, DISA STIGs, CIS Benchmarks). The ACAS Engineer will collaborate with other cybersecurity professionals, system administrators, and IT staff to identify vulnerabilities, track remediation efforts, and improve overall security.

Responsibilities:

• ACAS Implementation and Configuration:
• Install, configure, and maintain ACAS components, including Nessus scanners, SecurityCenter/Tenable.sc, and Nessus Network Monitor (NNM).
• Deploy and manage distributed scanning infrastructure across diverse network environments.
• Customize ACAS settings, policies, and scan templates to meet specific organizational requirements.
• Vulnerability Scanning and Analysis:
• Schedule and execute vulnerability scans using Nessus scanners.
• Analyze scan results to identify vulnerabilities, misconfigurations, and security gaps.
• Prioritize vulnerabilities based on severity, exploitability, and potential impact.
• Validate scan findings to minimize false positives.
• Compliance Assessment and Reporting:
• Configure ACAS to perform compliance assessments against industry standards and internal security policies.
• Generate comprehensive reports on vulnerability status, compliance posture, and remediation progress.
• Provide analysis and interpretation of assessment results to stakeholders.
• Develop custom reports and dashboards to visualize security metrics and trends.
• Remediation Support and Tracking:
• Collaborate with system administrators and IT staff to facilitate vulnerability remediation efforts.
• Provide guidance and technical assistance on vulnerability mitigation strategies.
• Track remediation progress and ensure timely resolution of identified issues.
• Re-scan systems to verify remediation effectiveness.
• System Administration and Maintenance:
• Perform system administration tasks for ACAS servers and databases.
• Monitor system performance and troubleshoot any issues.
• Apply security patches and software updates to ACAS components.
• Maintain accurate documentation of ACAS configuration and procedures.
• Threat Intelligence Integration:
• Integrate ACAS with threat intelligence feeds to enhance vulnerability detection capabilities.
• Correlate scan results with threat intelligence data to identify potential exploitation attempts.
• Customize ACAS policies to prioritize vulnerabilities based on threat landscape.
• Training and Documentation:
• Develop and maintain training materials for ACAS users.
• Provide training and support to IT staff on vulnerability management processes.
• Document ACAS procedures, policies, and best practices.
• Continuous Improvement:
• Stay up to date on the latest vulnerability trends and security threats.
• Research and evaluate new ACAS features and capabilities.
• Identify opportunities to improve ACAS effectiveness and efficiency.
• Contribute to the development of security policies and procedures.

The selected candidate will perform robust network security monitoring and proactively identify potential threats across our enterprise infrastructure. This role is critical for defending mission systems, conducting in-depth traffic and vulnerability analysis, and maintaining a strong security posture in support of Department of War (DOW) missions.

The Cyber Defense Analyst (Threat Hunter) is a vital role responsible for performing comprehensive network security monitoring and proactive threat hunting during swing-shift, weekend, and holiday coverage windows. This position focuses on safeguarding the network through continuous traffic analysis, vulnerability and wireless scanning, and leveraging enterprise tools such as SIEM, SOAR, CrowdStrike, CyberArk, and Endpoint Security Suite (ESS).

The Analyst will collaborate with cross-functional IT and security teams to:

• Implement Information Assurance Vulnerability Management (IAVM) programs
• Manage Network Access Control
• Provide insider threat support
• Monitor data at rest
• Review web content filtering
• Maintain and upkeep various cybersecurity applications and tools on servers and workstations to ensure high operational readiness during all covered hours

• Log Analysis & Threat Identification: Experience analyzing log files from network traffic logs, firewall logs, IDS logs, DNS logs and ESS to identify possible security threats (e.g., determine rogue systems, infected systems, unauthorized system changes, and unauthorized hardware connections).
• Policy Enforcement: Ability to identify violations of internet access by reviewing web content filtering logs in accordance with DoD policy, and Standard Operating Procedures (SOPs).
• Task Management: Experience in processing and handling JFHQ DODIN Cyber related tasks to completion.
• Proactive Threat Hunting: Performance of threat hunting activities using DOD approved cyber tools through data hunting, manipulation, and presentation, including generating queries and reports for management and the end-customer.
• Incident Assessment: Validation and confirmation of critical security events and assessing the impact of the event, by incorporating data from multiple tool sources.
• Investigation & Forensics: Identifying evidence of illegal activity involving cybercrime offenses and examining computers that may have been involved in other types of crime or malware infection.
• Malware Analysis: Use of forensic tools and investigative methods to find specific electronic data, namely associated with performing complex malware analysis.
• Process Documentation: Experience developing and maintaining SOPs for security monitoring.
• Reporting: Provide daily/weekly/monthly reports to senior leadership on key indicators of network security.

• Must be able to communicate complex technical ideas to a diverse customer base, both verbally and in written form.

ICS Nett, Inc is seeking a highly skilled Zero Trust Architect with a specialized focus on Enterprise Architecture and Identity, Credential, and Access Management (ICAM). The successful candidate will be the primary technical authority for designing, integrating, and maturing the enterprise Zero Trust Architecture (ZTA) in support of critical Department of War (DoW) missions. This role requires a strategic thinker who can develop a holistic enterprise-level security architecture grounded in Zero Trust principles. The position will be responsible for ensuring that ICAM is the central pillar of our security posture, protecting critical infrastructure and CUI within Impact Level 5 (IL5) environments. The ideal candidate will possess deep expertise in the DoW Zero Trust Strategy, enterprise architecture frameworks, and the implementation of advanced ICAM solutions. This position will support our DCSA Contract based in Quantico VA.

Remote flexibility available! Telework offered with a requirement to be onsite up to 2 days a week at Quantico, VA.

As a Zero Trust Architect, you will be a critical leader in our transition from traditional perimeter-based security to a comprehensive, identity-driven security model. Your primary focus will be on the enterprise architecture of our Zero Trust ecosystem, ensuring all security solutions and pillars — User, Device, Network, Application/Workload, Data, Visibility, and Automation/Orchestration — are cohesive, scalable, and fully integrated. You will leverage your expertise in Enterprise Architecture to develop and maintain the overall structure of the ZTA, while using your deep knowledge of ICAM to enforce granular, dynamic access control across the enterprise. This role involves close collaboration with mission owners, cybersecurity professionals, and IT staff to build a resilient and unified security framework that adheres strictly to the DoW Zero Trust Strategy.

The Cyber Defense Auditor uses a documented test plan and methodology and a variety of approved tools to conduct penetration tests and red/blue team operations for customer systems supporting the Defense Counterintelligence and Security Agency (DCSA) Hanover, MD.

Responsibilities:

• Develop enterprise Red / Blue team plans and testing schedules
• Brief results of penetration testing activities
• Simulate internal lateral movement activities observed in successful attacks
• Identify and report security deficiencies
• Provide advisement on countermeasures to mitigate threats
• Provide vulnerability-to-exploit mapping
• Perform system post-implementation security posture determination
• Provide penetration testing services in support of continuous diagnostic mitigation process
• Maintain overall tracker of penetration testing activities
• Perform Red / Blue Team scenarios, planning, operations, and reporting

ICS Nett, Inc is hiring a Cyber Incident Responder to join our dynamic team for swing shift from 2.00 PM to Midnight to provide support, including weekends and holidays, on rotation. This is an on-site position at Hanover, MD.

The candidate will serve as a front-line defender, detecting, triaging, containing, and eradicating cyber threats across our enterprise infrastructure. This role is critical for minimizing the impact of security incidents, coordinating response actions, and preserving forensic evidence in support of Department of Defense (DoD) missions.

Position Description

The Cyber Incident Responder will play an important role in executing the full incident response lifecycle during swing-shift, weekend, and holiday coverage windows. This position focuses on detecting and responding to security incidents in real time, performing containment and eradication actions, and coordinating recovery efforts using enterprise tools such as SIEM, SOAR, CrowdStrike, CyberArk, and Endpoint Security Suite (ESS).

The Incident Responder will collaborate with cross-functional IT and security teams to:

• Execute incident response procedures in accordance with NIST SP 800-61 and DoD guidelines

• Coordinate with JFHQ-DODIN on cyber incident reporting and remediation
• Support insider threat response and investigations
• Contain and remediate compromised systems, accounts, and endpoints
• Preserve and document forensic evidence for incident case management

Maintain incident response playbooks and ensure high operational readiness during all covered hours

ICS Nett, Inc is seeking a cleared Cybersecurity Cloud Engineer with strong AWS infrastructure skills to join our team. In this role, you will help implement, maintain, and monitor security controls across our secure cloud environments. Working closely with senior engineers and DevOps teams, you will configure secure AWS architectures, deploy Infrastructure-as-Code (IaC), and monitor cloud telemetry for potential threats. Experience with Elastic SIEM (Elastic Security) is highly valued and considered a strong bonus for this position.

Please note: This position requires compliance with Department of Defense (DoD) Directive 8570 and/or DoD Manual 8140 cyber workforce requirements.

Key Responsibilities:

• Cloud Security Configuration: Configure and maintain AWS VPC designs, subnets, security groups, and Network Access Control Lists (NACLs) according to established security baselines and DoD STIGs.

• Security Monitoring & Triage: Monitor security alerts using AWS native tools and SIEM platforms, triage potential threats, and assist in incident response and remediation within cleared environments.

• SIEM Support & Log Analysis: Assist with monitoring security telemetry and managing cloud logs (CloudTrail, VPC Flow Logs, GuardDuty). Experience working within or connecting logs to Elastic SIEM is a plus.

• Vulnerability Scanning: Run vulnerability assessments across cloud assets using tools like AWS Inspector, identify misconfigurations, and coordinate remediation timelines with engineering teams.

• Access Management Maintenance: Implement and audit IAM policies, roles, and resource permissions following the principle of least privilege.

• Documentation & Compliance: Help maintain technical security documentation and verify that cloud controls meet rigorous defense compliance requirements (such as NIST SP 800-53, FedRAMP, or DoD SRG).