> Markdown version of [/jobs/ext/4620004-incident-response-analyst-tier-3-ir-lead](https://www.wearedevelopers.com/jobs/ext/4620004-incident-response-analyst-tier-3-ir-lead). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Incident Response Analyst (Tier 3 / IR Lead) - **Company:** phia, LLC - **Location:** United States (Remote available) - **Experience:** Expert - **Salary:** $150,000.0 - $205,000.0 - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Data Analysis, Audit Trail, Microsoft Azure, Business Software, Cyber Security, Github, Identity and Access Management, Python (Programming Language), Unix Shell, Microsoft PowerPoint, RSA (Cryptosystem), Runbook, Security Information and Event Management, Web Services, Scripting, Mitre Att&ck, Cyber Threat Analysis, Cybercrime, Gsuite, 3-tier Architectures, Splunk, SentinelOne Expertise, Workday - **Published:** November 7, 2026 - **Apply:** https://www.builtincolorado.com/job/senior-incident-response-analyst-tier-3-ir-lead/12125515?handler=ApplyRedirect ## About the Role * Seasoned Responder: 5+ years of hands-on incident response experience. * Threat-Actor Experienced: You have handled an APT or FIN actor and responded to cloud-based threats (AWS or Azure/M365) in an IR capacity. * EDR Fluent: Hands-on with Microsoft Defender EDR (preferred); strong CrowdStrike or SentinelOne responders are considered. * SOC-Minded: Knowledge of SOC best practices and how a Tier 3 / IR team fits into them. * Automation-Minded: You'd rather write a SOAR playbook or a Python parser than click through the same triage twice. Comfortable in Splunk SPL and at a Linux shell. * Client-Ready: Comfortable working directly with clients and government staff - including a demanding one - with a professional demeanor. * Strong Writer: You write clear incident reports and can QA others' work. * Mentor: You have led or mentored junior analysts and reviewed their work., * 5+ years of experience with incident response. * Experience handling and responding to an APT or FIN actor and responding to cloud-based threats in an IR capacity. * Experience working directly with clients in a professional demeanor. * Experience with Microsoft Defender EDR (preferred) or an equivalent enterprise EDR such as CrowdStrike or SentinelOne. * Knowledge of SOC best practices. * Ability to work with government staff to suggest and implement process improvements, and to work with auditors to respond to and resolve identified issues in the IR processes. * Ability to author clear and robust reports and to review and ensure QA of team member submissions. * Senior-level Incident Response certification - GIAC GCIH is sufficient; GCFA, GCFR, GNFA, GREM, or EC-Council ECIH also accepted. * Ability to participate in a weekly after-hours on-call rotation. Preferred Skills * Experience with Splunk (SIEM) and Splunk SOAR, including playbook development. * Experience with GitHub for investigation tracking and documentation. * Experience with Archer (RSA/Archer GRC) as an incident system of record. * Experience responding to incidents in AWS (CloudTrail, GuardDuty, IAM/credential abuse). * Experience mapping activity to MITRE ATT&CK and following NIST 800-61. * Scripting for automation and triage (Python, SPL). * Threat hunting experience. * Ability to review work from junior analysts and provide feedback for growth. Required Education + Clearance * Education: Bachelor's Degree required * Certification: Senior-level Incident Response certification - GIAC GCIH is sufficient; GCFA, GCFR, GNFA, GREM, or EC-Council ECIH also accepted. * Clearance: Public Trust / Suitability; applicants selected will be subject to a security investigation. ## Description Focus Areas: Tier 3 Incident Response, APT/FIN Threat Actor Response, Cloud (AWS) Threat Response, Splunk & Splunk SOAR, Microsoft Defender EDR, and IR Reporting, QA & Mentoring, At phia we hire talented and passionate people who are focused on collaborative, meaningful work, providing technical and operational subject matter expertise and support services to our partners and clients. phia is seeking a mission-driven Senior Incident Response Analyst to serve as a hands-on responder supporting a federal financial regulatory agency's cybersecurity operations. You will be the most senior responder on the team: running incidents involving advanced persistent threat (APT) and financially motivated (FIN) actors and cloud-based attacks, mentoring and reviewing the work of fellow analysts, and authoring the clear, defensible reports a demanding client expects. Between incidents the IR team dual-hats as Tier 3 escalation for the SOC. You will work directly with government staff, independently with some guidance, and share a weekly on-call rotation with the rest of the team. What You'll Do * Respond to Incidents: Triage, investigate, contain, and remediate cybersecurity incidents, applying specific functional IR knowledge to drive them to resolution. * Lead & Mentor: Run incidents end to end as the most senior analyst on the team; review work from junior analysts and give feedback that helps them grow. * Respond to Advanced Actors: Handle and respond to APT and FIN threat actors and cloud-based threats (AWS), from initial detection through eradication and lessons learned. * Work the SOC Stack: Investigate in Splunk (SIEM) and Microsoft Defender EDR, build and tune Splunk SOAR playbooks, pull AWS telemetry, map activity to MITRE ATT&CK, and follow NIST 800-61 incident handling. * Prevent Recurrence: Recommend and implement process improvements with government staff; support auditors when IR processes are reviewed. * Cover On-Call: Participate in the team's weekly after-hours on-call rotation (approximately one week in six). * Report & Review: Author clear, robust incident reports in Archer (the system of record), track investigations and documentation in GitHub, and perform QA on team member submissions before they go to the client., Leads a team managing ADA and PWFA accommodation claims, ensuring accurate, timely, compliant claim adjudication and strong customer service. Responsibilities include coaching employees, managing performance and workloads, reviewing claim files and calls, identifying process improvements, administering concurrent disability and leave claims, mitigating risk, and communicating operational updates. The role requires disability or absence management expertise, sound judgment, knowledge of applicable regulations, and effective stakeholder collaboration. Top Skills: Microsoft Office Suite OneImaging Systems Administrator An Hour Ago Remote USA 60K-75K Annually Mid level 60K-75K Annually Mid level Healthtech Administer the company's SaaS, cloud, identity, endpoint, and security platforms. Manage access, SSO, MFA, SCIM, audit logging, vendor security, user lifecycle, device policies, and automation using scripts and APIs. Respond to security incidents, maintain compliance controls and runbooks, provide tier 1-2 IT support, manage hardware and assets, and document internal procedures. The role requires broad systems ownership across AWS, Google Workspace, Rippling, and numerous business applications. Top Skills: ActivecampaignAdobeAdvancedmdAircallAmazon Web Services (Aws)AnthropicAws CloudtrailAws GuarddutyAws IamAws Security HubBashBrazeDatabricksDatadogFigmaGoogle SecopsGoogle WorkspaceGreenhouseHipaaIntercomIntuneIso 27001JAMFKandjiLinearLinkedInLucidmacOSMdmMfaMongodb AtlasNordvpn TeamsNotionOpenai ApiPostmanPowershellPythonRest ApisRipplingSalesforceSAMLScimScribeSentrySoc 2SplunkSsoStytchTerraformTwilioVirtruWaystarWindowsZendeskZoom Liberty Mutual Insurance Technical Claims Specialist, Workers Compensation 2 Hours Ago Remote or Hybrid 75K-140K Annually Senior level 75K-140K Annually Senior level Artificial Intelligence * Fintech * Insurance * Marketing Tech * Software * Analytics Investigates, evaluates, reserves, negotiates, and resolves complex, high-severity workers compensation claims. Determines coverage and compensability, manages litigation and settlement activities, identifies fraud and subrogation opportunities, analyzes claims data, maintains reserves, advises management, and trains less experienced staff. Top Skills: ExcelMicrosoft Powerpoint What you need to know about the Colorado Tech Scene With a business-friendly climate and research universities like CU Boulder and Colorado State, Colorado has made a name for itself as a startup ecosystem. The state boasts a skilled workforce and high quality of life thanks to its affordable housing, vibrant cultural scene and unparalleled opportunities for outdoor recreation. Colorado is also home to the National Renewable Energy Laboratory, helping cement its status as a hub for renewable energy innovation. Key Facts About Colorado Tech * Number of Tech Workers: 260,000; 8.5% of overall workforce (2024 CompTIA survey) * Major Tech Employers: Lockheed Martin, Century Link, Comcast, BAE Systems, Level 3 * Key Industries: Software, artificial intelligence, aerospace, e-commerce, fintech, healthtech * Funding Landscape: $4.9 billion in VC funding in 2024 (Pitchbook) * Notable Investors: Access Venture Partners, Ridgeline Ventures, Techstars, Blackhorn Ventures * Research Centers and Universities: Colorado School of Mines, University of Colorado Boulder, University of Denver, Colorado State University, Mesa Laboratory, Space Science Institute, National Center for Atmospheric Research, National Renewable Energy Laboratory, Gottlieb Institute