Lead Analyst – Security Operations Incident Response

What you'll do

• Manage major incident response from identification and containment through recovery and post-incident review.
• Coordinate technical, business, and cross-functional stakeholders; maintain incident records and provide executive briefings.
• Improve incident readiness through playbooks, metrics, corrective actions, automation, and AI-enabled investigation.

What they ask for

• 7-10+ years of cybersecurity experience, with significant experience in Security Operations, Incident Response, DFIR, Threat Management, or Cyber Crisis Management.
• Experience managing high-severity, enterprise-scale incidents across multiple teams.
• Strong understanding of SIEM, SOAR, EDR/XDR, IAM, network and cloud security, threat intelligence, and vulnerability management.
• Knowledge of incident response frameworks such as NIST, SANS, and MITRE ATT&CK; working knowledge of AWS, Azure, or GCP.

Nice to have

• CISSP, GCIH, GCFA, GCFE, CISM, Security+, or equivalent incident response/security certifications.

Tools

SIEM, SOAR, EDR/XDR, IAM, AWS, Azure, GCP, MITRE ATT&CK

AI focus

Advance automation, Generative AI, and agentic AI to accelerate investigations and improve decision-making; use AI-enabled investigation and incident enrichment where appropriate.