Description
You are an experienced cybersecurity professional with a strong background in incident response and security operations.
You will investigate high-severity cybersecurity incidents from detection through containment, determining scope and coordinating response activities across global teams.
Responsibilities:
- Investigate high-severity cybersecurity incidents from detection through containment, determining scope and coordinating response activities across global teams
- Work directly with third-party cybersecurity and forensic providers during significant investigations, managing handoffs and maintaining continuity across teams and time zones
- Correlate and analyze data across multiple log sources, systems, and security technologies to investigate incidents and determine potential impact
- Collaborate with Detection Engineering and Threat Intelligence to improve alert quality, enrich detections, reduce unnecessary noise, and apply lessons learned from investigations
- Develop and tune security detections and contribute to the team's detection library, incident response procedures, documentation, and playbooks
- Deploy and support new security tools and capabilities across endpoint, cloud, and email security environments, including technologies such as CrowdStrike, Wiz, Proofpoint, and Abnormal
- Coordinate incident response activities with teams outside cybersecurity during major investigations and translate technical findings into clear, actionable guidance
- Contribute to security projects between incidents, including implementing new tools, developing automation, and establishing new security capabilities
- Stay current with evolving cyber threats and assess how emerging threats could affect the environment
- Leverage AI technologies, including LLM and agentic solutions, to improve security operations and help address alert scale
Requirements:
- 5+ years of hands-on cybersecurity experience in Incident Response, Security Operations, or a related security function, including significant experience investigating cybersecurity incidents
- Strong experience investigating active security incidents, including determining scope, coordinating containment, and working with multidisciplinary teams during response
- Experience working within formal incident response processes and coordinating activities across technical and business teams
- Experience collaborating with third-party cybersecurity or forensic providers during investigations
- Hands-on experience with SIEM and endpoint detection and response technologies, with the ability to investigate and correlate security activity across multiple data sources
- Strong log analysis and network analysis skills with the ability to correlate information across systems and security technologies during investigations
- Strong technical knowledge of common network protocols and technologies, including TCP/IP, HTTPS, FTP, SFTP, SSH, RDP, CIFS/SMB, and NFS
- Familiarity with cloud and SaaS environments, including AWS, Azure, and Microsoft 365
- Strong understanding of Windows environments and general knowledge of Unix, Linux, and macOS
- Understanding of MITRE ATT&CK and the NIST Cybersecurity Framework and how they apply within an enterprise environment
- Practical experience with at least 1 development or scripting language, such as PowerShell, Python, or .NET, as well as regular expressions
- Experience contributing to security initiatives outside active incident response, such as developing detections, deploying security tools, automating processes, or establishing new capabilities
- Strong written and verbal communication skills, with the ability to explain complex security issues clearly to technical and nontechnical stakeholders