Senior Incident Responder, Global CSIRT

What you'll do

• Investigate and respond to security incidents end-to-end, including triage, containment, eradication, and recovery.
• Analyze adversary activity, insider threats, and web application attacks across on-premises and multi-cloud environments.
• Contribute to process improvements, playbooks, and automation using SOAR tooling and detection-as-code.
• Produce clear incident documentation and status updates for both technical and non-technical stakeholders.
• Mentor newer incident responders and support the team's 24x7x365 on-call rotation.
• Perform host and network forensics across Windows, macOS, and Linux platforms to identify indicators of compromise.

What we're looking for

• You must have 5+ years of experience in information security, including hands-on operational security monitoring and incident response.
• You must be able to perform host and network forensics across Windows, macOS, and Linux environments.
• You must have experience responding to incidents in cloud environments including AWS, Azure, and/or GCP.
• You must have handled high-priority incidents such as insider investigations, adversary activity, and web application attacks.
• You must have a solid understanding of the threat landscape, including TTPs and frameworks like MITRE ATT&CK.
• You must be a U.S. citizen (born or naturalized) who does not hold dual citizenship.
• You must agree to complete a U.S. federal government Minimum Background Investigation for a Moderate Public Trust position.
• You should hold certifications such as SANS GCIH, GCFA, GCFE, GNFA, GPEN, GREM, or Offensive Security OSCP (preferred).