Senior Incident Handler

What you'll do

• Lead the full lifecycle of critical incidents from detection through containment, eradication, and recovery.
• Act as the primary technical anchor and incident commander during high-severity security events.
• Coordinate cross-functional teams including infrastructure, legal, communications, and third-party partners during active responses.
• Translate complex technical realities into clear business impact reports for executive leadership and stakeholders.
• Conduct advanced investigations into malware, identity compromise, ransomware, and targeted attacks using EDR/XDR and SIEM tools.
• Analyze network and forensic data to identify attacker tradecraft such as lateral movement and exfiltration.
• Implement AI-driven tooling and automation to accelerate triage and enrichment processes within the SOC.
• Improve team capabilities by developing playbooks, refining detections, and conducting after-action reviews.

What we're looking for

• Must have at least 5 years of experience in cybersecurity operations or incident response.
• Proven track record of leading complex, enterprise-scale incidents from detection through recovery.
• Demonstrated ability to act as an incident commander and technical lead during high-stakes events.
• Proficiency in network security, EDR/XDR, log analysis, forensic investigation, and threat hunting.
• Skilled in using SIEM tools and scripting for automation with Python or PowerShell.
• Ability to communicate complex technical information clearly to both engineers and executive leadership.
• Experience with SOAR, machine learning-based tooling, and LLMs to enhance response workflows.
• Preferred certifications include CISSP, GCIA, GCIH, GCFA, or OSCP.