--- title: 'Digital Forensics Incident Response Lead at Spry Methods' canonical: 'https://feeny.ai/job/digital-forensics-incident-response-lead-spry-methods-linthicum-3vr6dy24yz3q' type: 'job' last_seen: '2026-10-13' --- # Digital Forensics Incident Response Lead at Spry Methods - **Company:** Spry Methods - **Location:** Linthicum, MD - **Compensation:** $200k–$225k - **Employment:** full-time - **Work type:** onsite - **Posted:** 2026-10-07 - **Last confirmed live:** 2026-10-13 - **Apply:** https://jobs.lever.co/sprymethods/77c88d79-d05e-4a6e-9092-c73ad2ad52e7 ## Job description Spry Methods is seeking a Digital Forensics and Incident Response (DFIR) Lead to direct all DFIR activities at a government digital forensics laboratory. This position manages the intrusion analysis and incident response staff and gives them technical oversight. It is responsible for directing intrusion investigations and overseeing analysis of advanced persistent threat (APT) activity across multiple forensic and intelligence data sources. What Your Day-To-Day Looks Like (Position Responsibilities): - Lead CFL Digital Forensics and Incident Response activities. - Manage intrusion analysis and incident response personnel. - Direct network intrusion analysis, malware forensics, and memory analysis. - Lead intrusion investigations and monitor investigative quality and efficiency. - Analyze advanced persistent threat activity. - Correlate findings from host forensics, network logs, and threat intelligence. - Brief technical findings to Government leadership. - Ensure all intrusion and incident response activities comply with the PWS. - Serve as the primary Government technical point of contact for intrusion analysis and incident response. - Proactively identify and communicate technical, programmatic, and resource limitations. What You Need to Succeed (Minimum Requirements): - TS/SCI clearance eligible. - Active DFE, GCFA, GIAC Certified Incident Handler (GCIH), or equivalent certification approved by the COR. - At least seven years of hands-on Digital Forensics and Incident Response experience, including at least five years focused on network intrusion analysis, malware forensics, and memory analysis. - At least three years of leadership or supervisory experience within the last five years leading intrusion investigations, managing incident responders, and briefing technical findings to leadership. - Demonstrated experience within the last three years analyzing advanced persistent threat activity and correlating findings across host forensics, network logs, and threat intelligence. ## About Spry Methods ## Company Overview - **One-liner**: Spry Methods is a certified Small Business providing Cyber Security, National Security, Mission IT, and Intelligence Analysis solutions to the U.S. Federal Government, Department of Defense, and Intelligence Community. - **Entity Type**: Private (Bootstrapped) - **Headquarters**: McLean, Virginia, United States - **Founded**: 2001 - **Founders**: Not publicly available ## Core Business - **Primary industry/industries**: Information Technology & Services, Cybersecurity, National Security, Defense, Intelligence - **Target customers**: B2G (Business-to-Government) – primarily Federal Civilian agencies, the Department of Defense (DoD), and the Intelligence Community (IC); also serves commercial entities. - **Mission or purpose statement**: "Passionately serve others by creating value and making a difference." [topworkplaces.com](https://topworkplaces.com/company/spry-methods-inc/) ## Products & Services For each major offering: - **Cyber Security**: Provides on-the-ground cyber security expertise to national security missions, Federal law enforcement, and DoD partners. [sprymethods.com](https://sprymethods.com/) - **Intel Analysis**: Supports Law Enforcement (LE) and Intelligence Community (IC) across all intelligence disciplines, including OSINT, HUMINT, SIGINT, and GEOINT. [sprymethods.com](https://sprymethods.com/) - **National Security**: Delivers best-value, effective national security and intelligence services to solve complex, mission-critical challenges. [sprymethods.com](https://sprymethods.com/) - **Mission IT**: Supports federal agencies with DevSecOps, enterprise architecture, C5IT, and scalable cloud/on-premise solutions. [sprymethods.com](https://sprymethods.com/) ## Market Standing - **Valuation/Market Cap**: Not publicly available (private company) - **Key Metric**: Annual Revenue is reported as **$4.2M** by one source [datanyze.com](https://www.datanyze.com/companies/spry-methods/257704234) and **$19.7M** by another [datanyze.com](https://www.datanyze.com/companies/spry-methods/257704234) (conflicting reports). Headcount is approximately **103–141 employees**. - **Notable Investors/Partners**: Not publicly available (bootstrapped). Key clients include the DoD, Federal Civilian agencies, and the Intelligence Community. - **Growth Signals**: Headcount grew **+3.8% YoY** (adding ~4 people). LinkedIn followers grew **+16.5% over the past year** to 2,265. Active job postings increased **+140% month-over-month** (as of mid-2026). The company recently appointed a new COO (Nichole Gohman) and a new VP of Strategy (Amanda Rhames). [datanyze.com](https://www.datanyze.com/companies/spry-methods/257704234) ## Competitive Advantages - **Deep Government & Defense Specialization**: Focused exclusively on serving the DoD, IC, and Federal Civilian sectors – a high-barrier, high-trust market. - **Certifications & Compliance**: Holds ISO 9001:2015, ISO/IEC 20000:2018, ISO/IEC 27001:2018 registration, and is CMMI Level 3 certified for both Services and Development (CMMI-DEV and CMMI-SVC). [datanyze.com](https://www.datanyze.com/companies/spry-methods/257704234) - **Small Business Agility**: As a certified Small Business, Spry can offer the responsiveness and flexibility of a smaller firm while competing for large federal contracts. - **Longevity & Track Record**: Founded in 2001, Spry has over 25 years of proven past performance, including an acquisition of James Secure Solutions in 2013. [datanyze.com](https://www.datanyze.com/companies/spry-methods/257704234) ## Strategic Focus - **Growth & Leadership Expansion**: Recent hires for COO and VP of Strategy signal a focus on scaling operations and strategic planning. - **Talent Acquisition**: A surge in active job postings (+140% MoM) indicates aggressive hiring to support new or expanded contracts. - **Technology Modernization**: Emphasis on DevSecOps, cloud (Azure, AWS), and modern IT stacks (Kubernetes, Docker, Python) suggests a push toward agile, cloud-native solutions for mission partners. ## Why Work Here - **Mission-Driven Work**: Employees directly support national security, defense, and intelligence missions – work that has clear, high-impact purpose. - **Structured Yet Entrepreneurial Culture**: Described as "structured yet entrepreneurial" – employees are encouraged to "think, act and innovate." [topworkplaces.com](https://topworkplaces.com/company/spry-methods-inc/) - **Remote/Hybrid/Office Policy**: Roles appear to be primarily **hybrid** (e.g., McLean, VA and Washington, DC) or on-site, given the nature of government contracting. A recent posting for "HR & Contracts Administrator" lists a hybrid schedule in McLean, VA. [jobs.lever.co](https://jobs.lever.co/sprymethods) - **Employee Ratings**: 3.7/5.0 on employer review sites, with **Work-Life Balance rated highest at 4.4/5.0**. Culture rated 3.9/5.0. [datanyze.com](https://www.datanyze.com/companies/spry-methods/257704234) - **Tech Stack**: Engineers will work with modern tools including Kubernetes, Docker, Python, Azure, AWS, Terraform, Ansible, Splunk, and more. [datanyze.com](https://www.datanyze.com/companies/spry-methods/257704234) - **Notable Perks**: Not explicitly listed, but as a government contractor, likely offers competitive benefits, stability, and clearances. ## Sources 1. [sprymethods.com](https://sprymethods.com/) 2. [jobs.lever.co](https://jobs.lever.co/sprymethods) 3. [datanyze.com](https://www.datanyze.com/companies/spry-methods/257704234) 4. [topworkplaces.com](https://topworkplaces.com/company/spry-methods-inc/) 5. [linkedin.com](https://www.linkedin.com/company/sprymethods) ## Other roles at Spry Methods - [Digital Forensic Intrusions Lead](https://feeny.ai/job/digital-forensic-intrusions-lead-spry-methods-linthicum-57zbek5sfsg5) — Linthicum, MD - [Digital Forensic Extraction Lead](https://feeny.ai/job/digital-forensic-extraction-lead-spry-methods-linthicum-vstken7j597j) — Linthicum, MD - [Ditigal Forensic Examiner Lead](https://feeny.ai/job/ditigal-forensic-examiner-lead-spry-methods-linthicum-pv9qycr9ar39) — Linthicum, MD - [Cybersecurity Identity & Authentication/PKI Analyst](https://feeny.ai/job/cybersecurity-identity-authentication-pki-analyst-spry-methods-arlington-eseastwxtt2e) — Arlington, VA - [Facility Security Officer Manager - TS/SCI](https://feeny.ai/job/facility-security-officer-manager-ts-sci-spry-methods-linthicum-eh0tqmx091yz) — Linthicum, MD - [Cybersecurity Program Manager - TS/SCI](https://feeny.ai/job/cybersecurity-program-manager-ts-sci-spry-methods-linthicum-nh9pew3zgegm) — Linthicum, MD - [Enterprise Architect Program Manager - TS/SCI](https://feeny.ai/job/enterprise-architect-program-manager-ts-sci-spry-methods-linthicum-yhmapcm79f8p) — Linthicum, MD - [IT Program Manager - TS/SCI](https://feeny.ai/job/it-program-manager-ts-sci-spry-methods-linthicum-az7er9f210y6) — Linthicum, MD - [Technical Program Manager - TS/SCI](https://feeny.ai/job/technical-program-manager-ts-sci-spry-methods-linthicum-bamta4r6fmhm) — Linthicum, MD - [Technical Program Manager - TS/SCI](https://feeny.ai/job/technical-program-manager-ts-sci-spry-methods-linthicum-c41nyptjqcjp) — Linthicum, MD