Lead Senior Security Engineer, Incident Response, CSIRT, Cloud Security

What you'll do

• Design and facilitate incident response tabletop exercises for cross-functional teams to test preparedness and identify gaps.
• Manage the full incident lifecycle including detection, triage, containment, eradication, recovery, and post-incident review.
• Develop and maintain incident response plans, playbooks, and runbooks to ensure consistent and repeatable responses.
• Collaborate with threat intelligence, SOC, and engineering teams to improve detections and security controls based on findings.
• Conduct digital forensics investigations using industry-standard tools and frameworks like PICERL and NIST.
• Manage incident response activities within cloud environments using SIEM, CSPM, and other cloud security tools.
• Integrate AI and automation into incident response workflows and tabletop exercise processes.
• Communicate clearly with stakeholders at all levels during active incidents and in formal reporting.

What we're looking for

• Experience in enterprise incident response across the full lifecycle including detection, triage, containment, eradication, and recovery.
• In-depth experience designing and facilitating incident response tabletop exercises for cross-functional teams.
• Good working knowledge of forensics tools such as Magnet Axiom, Velociraptor, Volatility, FTK, or Autopsy.
• Knowledge of AWS cloud security fundamentals and other cloud security tooling like SIEM and CSPM.
• Understanding of cloud security and AI security concepts.
• Ability to communicate clearly with stakeholders at all levels during incidents and in reporting.
• Must have at least one of the following certifications: GCIH, GCFA, GCFE, AWS Certified Solutions Architect, or CISSP.