> Markdown version of [/jobs/ext/1502201-cyber-incident-responder](https://www.wearedevelopers.com/jobs/ext/1502201-cyber-incident-responder). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cyber Incident Responder - **Company:** Meriplex Solutions - **Location:** United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Amazon Web Services, Apple Mac Systems, Microsoft Azure, Software as a Service, Cloud Computing, Cyber Security, Linux, Issue Tracking Systems, Intrusion Detection and Prevention, Network Security, Remote Infrastructure Management, Security Information and Event Management, Mitre Att&ck, Firewalls (Computer Science), Information Technology, Cybercrime, CIS Benchmarks, SentinelOne Expertise, Vulnerability Analysis - **Published:** July 30, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=3c094b24c80739a1 ## About the Role * Advanced knowledge of incident response lifecycle activities, including detection, analysis, containment, eradication, recovery, and post-incident improvement. * Strong technical investigation skills across Windows, macOS, Linux, Microsoft 365 / Entra ID, Azure, AWS or other cloud platforms, endpoint protection, network security, email security, and common MSP tooling. * Experience with EDR/XDR and SIEM platforms such as SentinelOne, CrowdStrike, Microsoft Defender, Elastic/ELK, or comparable technologies. * Ability to identify attack vectors, persistence mechanisms, credential abuse, lateral movement, privilege escalation, data staging/exfiltration indicators, and common ransomware tradecraft. * Working knowledge of relevant frameworks and models such as NIST CSF, NIST SP 800-61, MITRE ATT&CK, CIS Controls, and cyber insurance or regulatory reporting considerations. * Demonstrated leadership under pressure, with the ability to make risk-informed decisions, prioritize competing tasks, and coordinate technical and non-technical resources without creating unnecessary confusion or delay. * Excellent customer communication skills, including the ability to explain incident facts, uncertainty, business risk, containment options, and recovery dependencies in plain language. * Strong written documentation skills, including executive summaries, technical timelines, incident action plans, investigation notes, and corrective action recommendations. * High degree of professionalism, discretion, integrity, and sound judgment when handling sensitive client data and high-impact security events. * Continuous improvement mindset with willingness to mentor others, improve process quality, automate repeatable work, and strengthen SOC operational maturity., * 4+ years of cybersecurity experience, including SOC operations, threat hunting, detection engineering, or closely related defensive security functions. * 2+ years of experience leading or coordinating incident response activities during high-priority incidents, preferably in an MSP, MSSP, consulting, or multi-client environment. * Demonstrated experience communicating with customers, executives, technical teams, and cross-functional stakeholders during active incidents. * Hands-on experience with endpoint, identity, cloud, email, and network investigations; ability to work directly in tools rather than only delegating technical analysis. * Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or equivalent practical experience preferred. Certifications: * GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), CISSP, CySA+, Microsoft SC-200, or equivalent certifications preferred. * Offensive security or cloud-specific certifications such as OSCP, PNPT, Microsoft Certified: Cybersecurity Architect, or comparable credentials are a plus. Physical Demands: Sedentary Work - Exerts up to 10 pounds of force occasionally, a negligible amount of force frequently, and/or constantly having to lift, carry, push, pull or otherwise move objects, including the human body. Sedentary work involves sitting most of the time. ## Description Impact: This role leads high-severity incident response for client environments, reducing client downtime, containing ransomware and hands-on-keyboard intrusions, coordinating recovery resources across MSP teams, and maintaining clear, calm, executive-ready client communications during active incidents., The Cyber Incident Responder is a senior technical role within the Security Operations Center responsible for leading response to confirmed or suspected cyber incidents across client environments. The role combines deep incident response expertise with practical leadership: directing technical containment, coordinating resources across SOC, service desk, infrastructure, cloud, networking, compliance, account management, and client leadership teams, and serving as a trusted communicator during high-pressure events. This position is hands-on and client-facing. The responder is expected to investigate endpoint, identity, cloud, email, network, and SaaS activity; determine scope and impact; recommend and execute containment and eradication steps; and translate technical findings into clear decisions, risks, and next steps for clients and internal stakeholders The role also improves SOC maturity by mentoring analysts, refining incident response playbooks, leading post-incident reviews, supporting tabletop exercises, and driving measurable improvements in detection, response, documentation, and recovery readiness., * Lead end-to-end incident response for high-severity and complex incidents, including triage, validation, scoping, containment, eradication, recovery support, and post-incident review., + Serve as technical incident lead and primary coordination point during major incidents, establishing response priorities, assigning actions, tracking decisions, and maintaining momentum across internal MSP/MSSP teams and client stakeholders * Conduct in-depth investigations of ransomware, business email compromise, credential compromise, endpoint malware, lateral movement, persistence, suspicious administrative activity, cloud compromise, and data exposure scenarios. * Analyze telemetry from EDR/XDR, SIEM, identity providers, email security platforms, firewalls, cloud platforms, vulnerability tooling, remote management tools, and ticketing systems to determine root cause, timeline, blast radius, and recommended response actions. * Develop, execute, and/or coordinate containment strategies such as host isolation, account disablement, token/session revocation, conditional access changes, firewall blocks, policy changes, IOC sweeps, and coordination of backup/recovery activities. * Coordinate evidence preservation and documentation, including collection of logs, timelines, artifacts, screenshots, containment actions, chain-of-custody notes when needed, and incident decision records. * Communicate incident status, risk, impact, and next steps clearly to technical and non-technical audiences, including client IT teams, client executives, internal leadership, account teams, legal/compliance stakeholders, and third-party partners. * Prepare concise client-facing incident updates, executive summaries, post-incident reports, root cause summaries, corrective action plans, and lessons-learned documentation. * Mentor Tier 1/Tier 2 SOC analysts and other technical teams on investigation methodology, escalation quality, containment standards, incident communications, and documentation expectations. * Maintain and improve incident response playbooks, escalation procedures, severity models, incident templates, customer communication standards, and internal handoff processes. * Support proactive threat hunting and detection engineering by converting incident learnings into improved SIEM queries, EDR detections, alert tuning, and response automation opportunities. * Participate in the on-call rotation and support 24/7 incident response operations for urgent or critical-impact incidents. * Contribute to security program maturity through tabletop exercises, operational readiness reviews, knowledge base articles, process improvements, and cross-department training. * Perform other duties as assigned, including support for peak workloads, coverage needs, audits, and special security initiatives. ## Related Videos - [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see) - [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)