Enter a job title or keyword
Incident Response and Security Operations Lead
Job Location:
Job Location:
Norristown, PA - USA
Monthly Salary:
Not provided by the employer
Monthly Salary:
Posted:
27 May 2026 (30+ days ago)
Posted:
Application Deadline:
24 August 2026
Application Deadline:
Vacancies:
1 Vacancy
Vacancies:
Job Summary
Technical Stack / Tools / Frameworks
NIST 800-61 NIST CSF Respond/Recover MITRE ATT&CK incident response playbooks SIEM platforms such as Microsoft Sentinel/Splunk/QRadar/LogRhythm EDR/XDR platforms such as Microsoft Defender/CrowdStrike/SentinelOne forensic tools malware analysis workflows SOAR concepts ticketing systems threat intelligence feeds IOC management vulnerability management platforms endpoint management tools backup/recovery coordination tools and executive incident dashboards.
NIST 800-61 NIST CSF Respond/Recover MITRE ATT&CK incident response playbooks SIEM platforms such as Microsoft Sentinel/Splunk/QRadar/LogRhythm EDR/XDR platforms such as Microsoft Defender/CrowdStrike/SentinelOne forensic tools malware analysis workflows SOAR concepts ticketing systems threat intelligence feeds IOC management vulnerability management platforms endpoint management tools backup/recovery coordination tools and executive incident dashboards.
Required Qualifications
10 years of experience in incident response security operations SOC leadership threat detection digital forensics coordination or cyber crisis management.
Experience leading incident response readiness programs tabletop exercises breach advisory engagements ransomware response and post-incident improvement planning.
Strong understanding of SIEM EDR/XDR SOC processes detection engineering escalation workflows evidence handling recovery coordination and operational cyber metrics.
Experience coordinating with legal communications executives infrastructure teams cloud teams IAM teams and third-party vendors during incidents.
Experience supporting public-sector healthcare justice public safety elections or other regulated environments preferred.
Ability to support hybrid delivery and be available for onsite coordination when required and authorized.
Preferred Certifications / Credentials
GCIH GCFA GCIA GREM CISSP CISM Security CySA Microsoft SC-200 or equivalent incident response/security operations certifications preferred.
