SOC Incident Commander

Job Summary

As a Cyber Security Incident Commander, you will be responsible for safeguarding our organization's digital assets by promptly identifying, analyzing, and responding to cyber security incidents. You will play a critical role in minimizing the impact of security breaches and preventing future incidents through proactive measures and continuous improvement of our incident response processes.

Responsibilities

• Incident command & response
• Serve as incident commander for mid-tier and major incidents: own the full lifecycle and direct cross-functional workstreams (IT, Legal, Communications/PR, Engineering, executives).
• Monitor alerts and logs; triage and prioritize incidents by severity, criticality, and business impact.
• Execute incident response playbooks to contain, mitigate, and remediate breaches, then restore affected systems and close off unauthorized access.
• Act as primary point of contact to executive leadership and the CISO, translating technical events into business-impact briefings.
• Forensics & analysis
• Conduct host, network, memory, and cloud/hybrid forensics to determine root cause, scope, and extent of compromise — preserving evidence and maintaining chain of custody to legal and regulatory standards.
• Perform malware triage and static/dynamic analysis, including sandbox detonation, to establish capability and indicators of compromise.
• Integrate threat intelligence and proactively hunt for adversary TTPs mapped to MITRE ATT&CK.
• Leverage AI-enabled tooling to accelerate triage, enrichment, and investigation (AI First mindset).
• Readiness & continuous improvement
• Own post-incident reviews and root cause analyses; capture lessons learned and drive remediation to closure.
• Develop and mature incident-response playbooks, tabletop exercises, and readiness drills.
• Organize and execute security exercises including Purple Team Exercises, penetration tests, and audits.
• Define and report IR metrics (MTTD, MTTR) and major-incident tracking to leadership.
• Program & collaboration
• Prepare detailed incident reports covering timeline, impact, remediation, and lessons learned.
• Coordinate with external parties including law enforcement, regulators, and third-party vendors.
• Develop security policies, procedures, and best practices; perform risk assessments and audits for compliance with industry standards.
• Evaluate and recommend security technologies, partnering with IT to design and implement solutions.
• Lead and mentor junior analysts, fostering continuous learning.
• Stay current on emerging threats, vulnerabilities, and industry trends.

Qualifications

• Bachelor’s degree in Computer Science or related field.
• Advanced certifications such as CISSP or incident-response/forensics GIAC certifications (GCIH, GCFA, GCFE, GNFA) are preferred
• Minimum five years experience in Information Technology
• Minimum three years of direct IT Security experience in Cyber Security operations and Incident Response
• Experience performing event and log analysis including one or more of the following: Anti-Virus, Intrusion Detection Systems, Firewalls, Active Directory, Web Proxies, Data loss prevention tools and other security tools found in large enterprise network environments; along with experience working with Security
• Ability to communicate complex information, concepts, or ideas in a confident and well-organized manner through verbal, written, and/or visual means
• Solid working knowledge of networking technology and tools, firewalls, proxies, IDS/IPS, encryption, SIEM and EDR
• Experience writing scripts, tools, or methodologies to enhance the investigative process
• Working knowledge of the MITRE ATT&CK framework and the NIST incident response lifecycle (NIST SP 800-61).
• Hands-on experience with industry-standard forensic toolsets and with cloud forensics across major cloud and productivity platforms.
• Familiarity with AI tools and an AI First mindset.