Lead, Incident Response

What you'll do

• Lead end-to-end response to high-severity incidents from initial triage through recovery and post-incident review.
• Serve as the senior technical escalation point and on-shift decision-maker for the incident response team.
• Investigate sophisticated adversaries, insider threats, and web application attacks across on-premises and multi-cloud environments.
• Design and build process improvements, playbooks, and automation using SOAR tooling and detection-as-code.
• Perform host and network forensics across Windows, macOS, and Linux to identify indicators of compromise.
• Analyze cloud environment incidents involving AWS, Azure, or GCP architectures and CI/CD pipelines.
• Mentor other responders and lead strategic initiatives to improve detection and response capabilities.

What we're looking for

• You must have 8+ years of experience in information security with substantial hands-on operational security monitoring and incident response experience.
• You must have experience performing host and network forensics across Windows, macOS, and Linux environments.
• You must have experience responding to incidents in cloud environments including AWS, Azure, and/or GCP.
• You must have a deep understanding of the threat landscape, attacker TTPs, and system/network hardening best practices.
• You must be a U.S. citizen (born or naturalized) who does not hold dual citizenship.
• You must agree to complete a U.S. federal government Minimum Background Investigation (MBI) for a Moderate Public Trust position.
• You should have recognized depth in malware analysis, detection engineering, forensics, cloud security, offensive security, or applied AI/ML for security (preferred).
• You should have prior experience in a 24x7x365 security operations environment (preferred).