Staff Incident Response Specialist

As part of our commitment to cybersecurity, we are looking for a skilled Incident Response Specialist to join our growing security operations team. In this role, you will play a crucial part in responding to, mitigating, and recovering from security incidents, ensuring that threats are identified and neutralized quickly to protect our infrastructure. You’ll work alongside a team of experts to continuously improve our incident response processes and reduce the organization's exposure to cyber risks.

The Incident Response Specialist will be responsible for detecting, investigating, and responding to security incidents across the organization. This includes identifying malicious activity, performing forensic analysis, coordinating response efforts, and helping to remediate incidents while minimizing business impact. You will be a key player in our security operations, applying your expertise to prevent incidents and strengthen our security posture.

Job Responsibilities:

• Incident Detection & Analysis:
  Monitor security alerts and logs from various sources, such as SIEMs, endpoint detection tools, firewalls, and IDS/IPS systems, to detect and analyze potential security incidents.
• Incident Response & Mitigation:
  Respond to security incidents by following established incident response processes. Identify, contain, and mitigate threats across network, cloud, and endpoint environments to limit damage and prevent escalation.
• Forensic Investigation:
  Perform forensic analysis to investigate security events, determine the scope and cause of incidents, and collect evidence for further analysis. Utilize tools such as EnCase, FTK, or open-source forensic tools for disk and memory analysis.
• Collaboration & Escalation:
  Work closely with internal teams, including IT, network operations, legal, and compliance, to coordinate incident response and escalation. Provide technical expertise and guidance throughout the response process.
• Incident Documentation & Reporting:
  Maintain detailed documentation of security incidents, including timelines, actions taken, lessons learned, and any recommendations for future prevention. Provide reports to management and other stakeholders, summarizing incidents and outcomes.
• Root Cause Analysis & Remediation:
  After an incident is contained, lead root cause analysis (RCA) efforts, identify weaknesses, and work with IT and engineering teams to implement corrective measures to prevent future incidents.
• Continuous Improvement:
  Contribute to the development and refinement of incident response procedures, playbooks, and runbooks. Recommend improvements to tools, processes, and technologies to enhance detection and response capabilities.
• Security Monitoring & Threat Intelligence:
  Stay up to date on the latest threats, vulnerabilities, and attack techniques by researching current cyber threats and integrating relevant threat intelligence into response strategies. Apply threat intelligence to improve detection and response efforts.
• Training & Awareness:
  Provide support in training and awareness initiatives for staff to improve overall incident response readiness. Assist in running tabletop exercises, simulation drills, and incident response training programs.
• Compliance & Legal Support:
  Ensure incident response practices align with relevant regulatory and compliance requirements (e.g., GDPR, HIPAA, PCI-DSS). Assist in supporting investigations, legal processes, and audits when required.

Job Requirements:

• Experience:
  • 6-9 years of experience in incident response, cybersecurity, or digital forensics.
  • Hands-on experience with incident response tools and technologies, such as SIEM (QRadar, Ms Sentinel), EDR (CrowdStrike, Defender), IDS/IPS, and forensic tools (e.g., EnCase, FTK, Autopsy).
  • Practical experience with investigating security incidents, including malware analysis, data breaches, ransomware attacks, and denial-of-service (DoS) incidents.
• Technical Skills:
  • Solid understanding of networking protocols, operating systems (Windows, Linux, macOS), and security technologies (firewalls, IDS/IPS, endpoint protection).
  • Familiarity with common attack vectors, malware, and exploitation techniques (e.g., phishing, privilege escalation, lateral movement).
  • Ability to analyze system logs, network traffic, and other security data to identify signs of compromise.
  • Experience with scripting languages (e.g., Python, PowerShell, Bash) for automation and analysis tasks.
• Certifications (Preferred):
  • Certified Incident Handler (GCIH)
  • Certified Information Systems Security Professional (CISSP)
  • GIAC Certified Forensic Analyst (GCFA)
  • Certified Ethical Hacker (CEH)
  • AWS Certified Security Specialty or equivalent certifications.
• Soft Skills:
  • Strong analytical and problem-solving abilities, with a keen attention to detail.
  • Excellent written and verbal communication skills, with the ability to explain complex technical issues to non-technical stakeholders.
  • Ability to work independently and collaboratively in a fast-paced, high-pressure environment.
  • Strong organizational skills, with the ability to manage multiple incidents and priorities simultaneously.