Key Responsibilities

• Leading security incidents in a cross-functional and collaborative environment, targeting incident resolution & mentoring team members to continue to scale in a high-growth environment.
• Developing IR initiatives that improve our capabilities to respond and swiftly remediate security events.
• Creating a culture of accountability, quality, agility, and high performance that will foster the attraction, development, and retention of security analysts.
• Responsible for being a focal incident response point for all within the organization. This includes being able to provide initial analysis and identification of IOC’s, escalation to the appropriate business units, and post-incident activities.
• Oversee Incident Response Plans: Design, implement, and manage the client's incident response policies and procedures to ensure preparedness.
• Coordinate Incident Response Teams: Lead cross-functional teams during security incidents, ensuring an organized and timely response.
• Triage and Prioritize Incidents: Assess incidents for severity and potential impact, assigning appropriate resources and setting response priorities.
• Serve as technical point of contact during an incident, providing updates to internal and external stakeholders.
• Serve as an incident manager, reporting key findings, barriers, escalations, and concerns to the Director of Global Incident Response Operations, while liaising with Legal, the Director of Sales, and the IRC team.
• Maintain and prepare departmental reports for Key Performance Indicators (KPIs) to be presented to the Global Head of Incident Response Operations and EVP Sales & Revenue as needed.
• Responsible for supporting a wide number of technologies and being able to proficiently perform advanced troubleshooting on the fly (packet captures, debugs, traffic analysis).
• Responsible for developing and documenting Incident Response methods and guidelines for the organization.
• Support the department's DFIR tooling selection process and any proof-of-concept projects.
• Chain of Custody: Ensure that evidence is collected, handled, and preserved in a legally defensible manner, maintaining the chain of custody for potential litigation.
• Perform live-endpoint investigation.
• Implement and deploy an Incident Response-focused ticketing system to improve incident tracking, remediation, and metrics for incidents worked.
• Post-incident Analysis: Conduct root cause analysis after incidents to identify vulnerabilities and develop strategies to prevent recurrence.
• Responsible for working with 3rd parties to assist with incident response, business email compromise, security breach, improving overall security, investigations, recommendations, and remediation.
• Assist Sales and SOC in the successful conversion from incident response, PBR, RMS, eDiscovery to SOC, including process and procedure build-out.
• Budget and Resource Management: Oversee the allocation of resources, including personnel, tools, and budgets, to effectively manage incident response and forensics operations.
• Monitor and Manage Regional profit & loss metrics and requirements.
• Create, maintain, and enhance an onboarding program that is concise and repeatable, effectively covering all aspects of the CERT role.
• Client Education: Raise awareness across external organisations about digital forensics, incident response protocols, and security best practices.
• Maintain and manage AWS instances to ensure timely deletion and removal of data to minimize company and customer fees/overages.

Attributes

• Successful track record of helping to implement security initiatives and frameworks flexibly and innovatively.
• A collaborative approach to decision-making and the ability to influence with minimal guidance.