SOC Incident Commander

As a Cyber Security Incident Commander you will be responsible for safeguarding our organizations digital assets by promptly identifying analyzing and responding to cyber security incidents. You will play a critical role in minimizing the impact of security breaches and preventing future incidents through proactive measures and continuous improvement of our incident response processes.

• Incident command & response
• Serve as incident commander for mid-tier and major incidents: own the full lifecycle and direct cross-functional workstreams (IT Legal Communications/PR Engineering executives).
• Monitor alerts and logs; triage and prioritize incidents by severity criticality and business impact.
• Execute incident response playbooks to contain mitigate and remediate breaches then restore affected systems and close off unauthorized access.
• Act as primary point of contact to executive leadership and the CISO translating technical events into business-impact briefings.
• Forensics & analysis
• Conduct host network memory and cloud/hybrid forensics to determine root cause scope and extent of compromise preserving evidence and maintaining chain of custody to legal and regulatory standards.
• Perform malware triage and static/dynamic analysis including sandbox detonation to establish capability and indicators of compromise.
• Integrate threat intelligence and proactively hunt for adversary TTPs mapped to MITRE ATT&CK.
• Leverage AI-enabled tooling to accelerate triage enrichment and investigation (AI First mindset).
• Readiness & continuous improvement
• Own post-incident reviews and root cause analyses; capture lessons learned and drive remediation to closure.
• Develop and mature incident-response playbooks tabletop exercises and readiness drills.
• Organize and execute security exercises including Purple Team Exercises penetration tests and audits.
• Define and report IR metrics (MTTD MTTR) and major-incident tracking to leadership.
• Program & collaboration
• Prepare detailed incident reports covering timeline impact remediation and lessons learned.
• Coordinate with external parties including law enforcement regulators and third-party vendors.
• Develop security policies procedures and best practices; perform risk assessments and audits for compliance with industry standards.
• Evaluate and recommend security technologies partnering with IT to design and implement solutions.
• Lead and mentor junior analysts fostering continuous learning.
• Stay current on emerging threats vulnerabilities and industry trends.

• Bachelors degree in Computer Science or related field.
• Advanced certifications such as CISSP or incident-response/forensics GIAC certifications (GCIH GCFA GCFE GNFA) are preferred
• Minimum five years experience in Information Technology
• Minimum three years of direct IT Security experience in Cyber Security operations and Incident Response
• Experience performing event and log analysis including one or more of the following: Anti-Virus Intrusion Detection Systems Firewalls Active Directory Web Proxies Data loss prevention tools and other security tools found in large enterprise network environments; along with experience working with Security
• Ability to communicate complex information concepts or ideas in a confident and well-organized manner through verbal written and/or visual means
• Solid working knowledge of networking technology and tools firewalls proxies IDS/IPS encryption SIEM and EDR
• Experience writing scripts tools or methodologies to enhance the investigative process
• Working knowledge of the MITRE ATT&CK framework and the NIST incident response lifecycle (NIST SP 800-61).
• Hands-on experience with industry-standard forensic toolsets and with cloud forensics across major cloud and productivity platforms.
• Familiarity with AI tools and an AI First mindset.