Incident Response Analyst
Posted
Description
- Lead and perform end-to-end Incident Response and Digital Forensics investigations, from initial scoping through containment, forensic investigation, remediation, and final reporting.
- Perform forensic analysis of compromised Windows and other enterprise systems to determine initial access, root cause, attacker activity, persistence, lateral movement, scope, and impact.
- Analyze endpoint, operating system, authentication, network, and security telemetry to reconstruct attacker activity and identify indicators of compromise.
- Lead response efforts during complex, large-scale, and global security incidents.
- Perform enterprise-wide compromise assessments to identify affected systems and evidence of malicious activity.
- Develop clear containment, eradication, recovery, and remediation recommendations.
- Produce detailed, high-quality incident investigation reports documenting attack vectors, attacker TTPs, findings, impact, and recommended actions.
- Clearly communicate technical findings and incident status to customer technical teams and senior stakeholders.
- Develop and improve incident response plans, procedures, and playbooks.
- Design realistic cyberattack scenarios and facilitate tabletop exercises.
- Build and maintain forensic and malware-analysis lab environments.
- Collaborate with global incident responders, forensic investigators, security researchers, and customer teams.
- 5+ years of cybersecurity experience.
- Minimum 2 years of hands-on DFIR/Incident Response experience investigating confirmed system or enterprise compromises.
- Demonstrated experience conducting forensic investigations to determine:
- Initial access and root cause
- Persistence mechanisms
- Credential compromise
- Privilege escalation
- Lateral movement
- Attacker TTPs
- Scope and impact of compromise
- Hands-on experience analyzing Windows forensic artifacts, endpoint telemetry, event logs, authentication activity, and network evidence.
- Experience responding to complex incidents such as ransomware, identity compromise, malware infections, and enterprise intrusions.
- Ability to independently scope and drive an investigation and develop defensible remediation recommendations.
- Strong experience producing customer-facing incident reports and presenting technical findings clearly.
- Experience developing incident response plans and playbooks.
- Strong analytical, troubleshooting, and communication skills.
- Ability to work effectively during high-severity incidents requiring coordination across multiple teams and geographies.
- Ability to participate in an on-call rotation, including at least one weekend per month.
- Domestic and international travel may be required.