Key Responsibilities
Technical triage and investigation
Perform deep-dive analysis of escalated alerts and suspected incidents across endpoint, identity, email, network, and cloud telemetry.
Reconstruct attacker and user activity into a defensible timeline establishing what happened, when, and what was affected.
Determine the scope of compromise, including affected accounts, systems, and data.
Establish root cause and distinguish confirmed findings from assumptions in every write-up.
Containment, eradication, and recovery
Recommend and support containment actions such as account disablement, host isolation, credential resets, and access revocation.
Work with IT and platform owners to execute eradication and recovery steps with the least business disruption the situation allows.
Validate that containment held and that no attacker access or persistence remains before an incident is closed.
Capture technical remediation items and hand them to the Incident Response Manager for tracking to closure.
Forensics and evidence handling
Collect and preserve digital evidence from endpoints, cloud services, and logs, following sound handling and chain-of-custody practice.
Conduct host and log forensic analysis in support of security, HR, Legal, and privacy investigations.
Analyze suspicious files, email, and indicators to determine intent and impact, engaging external specialists when depth exceeds internal capability.
Produce clear technical reports that hold up to legal, regulatory, and audit scrutiny.
Response readiness and continuous improvement
Maintain and improve technical response playbooks, tooling, and evidence collection procedures.
Feed incident findings to the Lead Threat Hunter so hunting and detection coverage matures against what has actually occurred in the environment.
Contribute the technical detail behind post-incident reviews, including what happened and what would have surfaced it sooner.
Support tabletop and ransomware exercises, providing the technical realism these exercises depend on.
Qualifications
3 to 5+ years of hands-on experience in incident response, digital forensics, or security operations, preferably in a large company or consulting firm.
Undergraduate degree, preferably in Information Security, Computer Science, Information Technology, or a related discipline.
Demonstrated experience investigating security incidents end to end, from initial alert through root cause and closure.
Working knowledge of attacker tradecraft and a common framework for describing it, along with the operating system, identity, and cloud internals needed to investigate it.
Practical experience with endpoint detection and response tooling, log aggregation and SIEM query languages, and cloud audit logging.
Strong technical writing skills, with the ability to produce an incident timeline and root cause analysis a non-specialist can follow.
Ability to work calmly and methodically under time pressure, with flexibility to extend beyond scheduled hours when an active incident requires it.
Willingness to work US business hours as needed, coordinating daily with a primarily US-based security team.
Preferred Skills
Security certifications such as GCIH, GCFA, GCFE, GNFA, OSCP, or similar.
Experience with digital forensics tooling, including memory and disk analysis.
Scripting experience (e.g., Python, PowerShell, KQL) used to automate collection, parsing, and analysis.
Exposure to malware triage or reverse engineering fundamentals.
Experience supporting insider risk, DLP, or privacy investigations alongside external threat cases.
Working knowledge of network protocols and traffic analysis, including the ability to interpret firewall, proxy, DNS, and VPN logs to trace activity across the environment.
Familiarity with cloud platform architecture and native logging across at least one major provider (e.g., Azure, AWS, M365), spanning identity, storage, and workload telemetry, and how each is commonly abused.
Understanding of application and web security fundamentals, including common vulnerability classes and how exploitation attempts present in application and access logs.
Experience working across time zones with distributed, cross-functional teams, including US-based stakeholders.
Analytical problem-solving skills, including the ability to synthesize technical evidence into a format that supports leadership decision-making.
- Position Level
- Senior Associate
