Role: Senior Incident Response Lead
Investigate incidents, drives detection strategy, major incident leadership, threat hunting, automation, and security operations maturity.
Location Remote
Shift: 9AM CST to 6PM CST (6:30PM ? 4:30AM IST) + On-call rotation 8 AM CST to 8 AM CST next day, Weekends 2 HRs - Mail for alerts check.
Role Overview
We are seeking a highly experienced cybersecurity professional to lead enterprise-wide incident response, threat investigations, and detection engineering initiatives. This role serves as the senior escalation point for critical security incidents, advanced threat hunting activities, SOC optimization, and incident response governance.
The ideal candidate will possess deep expertise in incident response, digital forensics, SIEM engineering, threat intelligence, cloud security, and security operations leadership. This individual will be responsible for leading complex investigations, mentoring analysts, enhancing detection capabilities, and partnering with executive stakeholders during major security events. Based on the existing requirements for advanced incident investigation, SIEM use case development, and leadership expectations.
Key Responsibilities
Incident Response Leadership
Lead enterprise-wide investigations involving ransomware, insider threats, account compromise, data exfiltration, business email compromise, and advanced persistent threats (APT).
Serve as Incident Commander during Severity 1 and Severity 2 cybersecurity incidents.
Coordinate investigations across Security, Infrastructure, Cloud, Networking, Application, Legal, Privacy, and Executive Leadership teams.
Develop incident response playbooks, runbooks, and escalation procedures.
Conduct executive-level incident briefings and post-incident reviews.
Detection Engineering & Security Monitoring
Own SIEM content strategy and detection engineering roadmap.
Design, develop, and optimize detection use cases across SIEM and EDR platforms.
Reduce false positives through tuning and threat-informed detection improvements.
Develop advanced detection logic using behavioral analytics, threat intelligence, and MITRE ATT&CK mapping.
Threat Hunting
Lead proactive threat hunting campaigns across endpoint, network, cloud, and identity environments.
Develop hunting methodologies using IOC, IOA, TTP, and adversary emulation techniques.
Identify gaps in security visibility and monitoring coverage.
Digital Forensics & Malware Analysis
Lead forensic investigations involving endpoints, servers, cloud workloads, and user activities.
Perform memory analysis, timeline reconstruction, malware triage, and evidence preservation.
Support legal, compliance, and regulatory investigations when required.
Security Operations Excellence
Establish SOC metrics, KPIs, MTTD, MTTR, and detection coverage measurements.
Drive automation initiatives utilizing SOAR technologies.
Enhance incident response processes through continuous improvement programs.
Develop analyst training, simulation exercises, and tabletop scenarios.
Leadership & Mentorship
Mentor SOC Analysts, Incident Responders, Threat Hunters, and Detection Engineers.
Review investigation quality and technical reports.
Act as final escalation authority for high-risk alerts and incidents.
Participate in hiring, training, and performance development initiatives.
Required Experience
Experience
12+ years of overall cybersecurity experience.
8+ years in Cybersecurity Operations and Incident Response.
5+ years leading complex security investigations and response teams.
Experience handling enterprise environments with 5,000+ endpoints and multi-cloud deployments.
Proven experience serving as Incident Commander during critical security incidents.
Experience creating incident response programs and operating procedures. The original JD emphasizes creating processes where none exist and leading multi-team investigations.
Technical Expertise
Incident Response
Advanced expertise across all phases of Incident Response:
Preparation
Identification
Containment
Eradication
Recovery
Lessons Learned
Building upon the extensive investigation and response requirements specified in the current JD.
Security Platforms
Expert-level knowledge of:
Microsoft Sentinel
Google SecOps
Splunk Enterprise Security
IBM QRadar
CrowdStrike Falcon
Microsoft Defender XDR
Carbon Black
Palo Alto Cortex XDR
Zscaler
ServiceNow Security Operations
Related SIEM, EDR, and security tool expectations align with the current role requirements.
Threat Detection & Engineering
SIEM rule engineering
Detection as Code
Sigma Rules
YARA Rules
MITRE ATT&CK Framework
Threat Modelling
Purple Team Exercises
Infrastructure & Cloud
Expert knowledge of:
Windows Server
Linux
Active Directory
Azure
AWS
Google Cloud Platform
Kubernetes
Identity Security
The current JD requires mastery of Windows, Linux, and networking fundamentals.
Forensics & Analysis
Volatility
FTK
EnCase
Velociraptor
Wireshark
NetWitness
Memory Analysis
Network Packet Analysis
These advanced skills extend the packet and memory analysis tool requirements already identified.
Preferred Certifications
One or more of the following:
GIAC GCFA
GIAC GCIH
GIAC GNFA
GIAC GRID
CISSP
CCSP
GCFE
OSCP
CARTP
Microsoft SC-200
Google SecOps Certification
Leadership Competencies
Executive communication and stakeholder management.
Strong incident command capabilities.
Ability to remain composed under pressure.
Strategic thinker with operational execution focus.
Strong mentoring and coaching skills.
Data-driven decision maker.
These leadership expectations evolve the current requirement for confidence, leadership mentality, judgment, proactivity, and advanced problem-solving.