Senior Incident Responder, Global CSIRT

What you'll do

• Investigate and respond to security incidents end-to-end, including triage, containment, eradication, and recovery.
• Lead high-priority investigations into adversary activity, insider threats, and web application attacks.
• Perform host and network forensics across Windows, macOS, and Linux environments to identify indicators of compromise.
• Develop and improve incident response playbooks, detection-as-code, and SOAR tooling to reduce response times.
• Produce clear incident documentation and status updates for both technical and non-technical stakeholders.
• Mentor junior incident responders and provide guidance on complex security investigations.
• Participate in a 24x7x365 on-call rotation to support critical security monitoring and response.

What we're looking for

• You must have 5+ years of experience in information security, including hands-on operational security monitoring and incident response.
• You must be able to perform host and network forensics across Windows, macOS, and Linux systems.
• You must have experience responding to incidents in cloud environments (AWS, Azure, and/or GCP).
• You must possess a solid understanding of the threat landscape, including TTPs and frameworks like MITRE ATT&CK.
• You must be able to communicate clearly in writing and verbally while documenting incidents effectively for various stakeholders.
• Preferred certifications include SANS GCIH, GCFA, GCFE, GNFA, GPEN, GREM, or Offensive Security OSCP.
• You must be a U.S. citizen (born or naturalized) who does not hold dual citizenship.
• You must be able to pass a U.S. federal government Minimum Background Investigation (MBI).