Incident Response Analyst

Hands-on incident response position supporting active cybersecurity incidents from initial investigation through containment, scoping, eradication, and recovery. This role will work directly on ransomware, business email compromise, credential theft, cloud compromise, lateral movement, data exfiltration, and other active security incidents. Remote position, must currently live in the U.S. and not require sponsorship or a 3^rd party at any time.

Target Candidate

• Professional hands-on incident response experience
• Strong Windows endpoint investigation experience
• Strong understanding of Active Directory, Entra ID, Microsoft 365, authentication, and identity-related attacks
• Experience responding to ransomware, BEC, compromised accounts, persistence, credential access, lateral movement, and data exfiltration
• Strong EDR experience; CrowdStrike experience strongly preferred
• Experience analyzing endpoint, authentication, identity, network, email, and cloud telemetry
• Ability to scope incidents and identify affected users, systems, accounts, and infrastructure
• Experience identifying attacker activity and reconstructing attack timelines
• Comfortable making containment and remediation recommendations during active incidents
• Ability to operate effectively during high-pressure and rapidly evolving incidents
• Strong investigative documentation and case management discipline
• Ability to communicate findings clearly to senior technical personnel, engagement leadership, clients, and other stakeholders
• Digital forensics experience is beneficial, but this position should be incident-response-first
• Currently reside in the U.S. and be eligible to work for any U.S. employer without ever requiring sponsorship or a 3rd party
• Able to pass a background check

Level: Analyst / Senior Analyst depending on experience

Preference: Experienced responder capable of independently owning significant portions of an active incident while coordinating effectively with senior DFIR personnel.