Lead Incident Response Analyst

As a Lead Incident Response Analyst , you will be a senior member of Hologic’s enterprise Threat Detection and Response team. The team provides 24x7x365 monitoring of security-related information sources to detect and manage cyber, privacy, and data-protection incidents affecting Hologic data and infrastructure. The team regularly hunts across the Hologic network for signs of compromise, malware, or unauthorized access; develops and maintains incident response plans, playbooks, and procedures; and collects and analyzes incident response data.

Your Daily Impact at Hologic:

• Lead security incidents from detection through containment, eradication, and recovery, serving as incident commander and coordinating response across IT, Legal, Privacy, Communications, and business stakeholders.
• Stay current on relevant vulnerabilities, threat actors, indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs), and emerging trends, and turn that intelligence into actionable insights.
• Partner with Crisis Management to activate and execute crisis procedures when necessary.
• Use threat intelligence to proactively hunt across the Hologic enterprise for anomalous or malicious activity.
• Work with Security Engineering to baseline user behavior and events, and to build new detections and response workflows.
• Mentor and guide analysts, review investigations and escalations, and set quality standards for the team’s detections, playbooks, and case documentation.
• Lead post-incident reviews, documenting root cause and lessons learned, and drive remediation actions to closure.
• Recommend and build countermeasures based on threat analysis and intelligence.
• Develop, implement, and maintain security incident playbooks and runbooks, including building SOAR-driven automation workflows.
• Routinely test and improve operational effectiveness through purple team exercises.
• Prepare and present findings and recommendations through briefings, reports, and dashboards to managers, team leads, and senior leadership.
• This position supports a 24x7x365 operation and may require shift and/or on-call work, including weekends.

• Bachelor’s degree in a related field, or equivalent experience
• 5+ years of information security experience, focused on incident response or threat detection
• Demonstrated experience leading incidents and mentoring or guiding other analysts
• Strong knowledge of incident response principles and processes
• Experience with EDR (Endpoint Detection & Response) analysis and rule creation , and with dissecting attacker tactics and techniques
• Expert-level experience with Splunk , including reporting and data correlation
• Excellent analytical and problem-solving skills
• A learning mindset and enthusiasm for new technologies and security disciplines
• Bonus points for:
• In-depth knowledge of Splunk’s architecture and underpinnings
• Previous experience in cloud-native or technology environments
• Network or Linux knowledge
• Programming or scripting experience
• Experience developing SOAR workflows, including agentic and non-agentic automation (training provided for candidates new to SOAR)
• Security certifications such as GCTI, GCIH, GCIA, or GPEN

The annualized base salary range for this role is $114,000 - 178,300 and is bonus eligible. Final compensation packages will ultimately depend on factors including relevant experience, skillset, knowledge, geography, education, business needs, and market demand.