Incident Response Analyst

Job Description

• Lead and perform end-to-end Incident Response and Digital Forensics investigations, from initial scoping through containment, forensic investigation, remediation, and final reporting.
• Perform forensic analysis of compromised Windows and other enterprise systems to determine initial access, root cause, attacker activity, persistence, lateral movement, scope, and impact.
• Analyze endpoint, operating system, authentication, network, and security telemetry to reconstruct attacker activity and identify indicators of compromise.
• Lead response efforts during complex, large-scale, and global security incidents.
• Perform enterprise-wide compromise assessments to identify affected systems and evidence of malicious activity.
• Develop clear containment, eradication, recovery, and remediation recommendations.
• Produce detailed, high-quality incident investigation reports documenting attack vectors, attacker TTPs, findings, impact, and recommended actions.
• Clearly communicate technical findings and incident status to customer technical teams and senior stakeholders.
• Develop and improve incident response plans, procedures, and playbooks.
• Design realistic cyberattack scenarios and facilitate tabletop exercises.
• Build and maintain forensic and malware-analysis lab environments.
• Collaborate with global incident responders, forensic investigators, security researchers, and customer teams.

Qualifications

• 5+ years of cybersecurity experience.
• Minimum 2 years of hands-on DFIR/Incident Response experience investigating confirmed system or enterprise compromises.
• Demonstrated experience conducting forensic investigations to determine:
  • Initial access and root cause
  • Persistence mechanisms
  • Credential compromise
  • Privilege escalation
  • Lateral movement
  • Attacker TTPs
  • Scope and impact of compromise
• Hands-on experience analyzing Windows forensic artifacts, endpoint telemetry, event logs, authentication activity, and network evidence.
• Experience responding to complex incidents such as ransomware, identity compromise, malware infections, and enterprise intrusions.
• Ability to independently scope and drive an investigation and develop defensible remediation recommendations.
• Strong experience producing customer-facing incident reports and presenting technical findings clearly.
• Experience developing incident response plans and playbooks.
• Strong analytical, troubleshooting, and communication skills.
• Ability to work effectively during high-severity incidents requiring coordination across multiple teams and geographies.
• Ability to participate in an on-call rotation, including at least one weekend per month.
• Domestic and international travel may be required.

Additional Information