Incident Response Analyst – Mid-Senior Level

This is a fully remote position, open to applicants in Texas.

📋 Description

• Execute thorough incident response operations in accordance with the NIST Cybersecurity Framework throughout all stages: Initial Detection, Analysis & Validation, Containment, Eradication, Recovery, and Post-Incident Activity.

• Address cyber incidents affecting TMNA Corporate, Manufacturing Facilities, Third-Parties, Dealerships, and RSOC Customers.

• Conduct digital forensic investigations, which include the collection, processing, and analysis of forensic evidence from Windows, Linux, macOS, and mobile platforms.

• Maintain an "Always Be Timelining" (ABT) mindset, consistently updating incident timelines as new findings emerge.

• Facilitate proactive, reactive, and exploratory threat hunting initiatives throughout the ecosystem.

• Evaluate emerging cyber threats, analyze attacker TTPs, and monitor threat actors/groups to foresee and lessen potential attacks.

• Collaborate with the 24/7 SOC, Threat Detection Engineering, Vulnerability Management, and Insider Risk Management teams.

• Create and present forensic reports, incident communications, and executive briefings during active incidents.

• Engage in a weekly on-call rotation schedule to provide 24/7 incident response coverage.

• Perform behavioral and static malware analysis utilizing TRRAC Labs' dynamic analysis capabilities.

• Assist in the development, refinement, and upkeep of incident response playbooks, SOPs, and training materials.

• Participate in quarterly tabletop exercises to evaluate incident response workflows and controls.

• Keep abreast of emerging threats, attacker methodologies, and industry best practices.

⛳️ Requirements

• A minimum of 3-5 years of practical experience in incident response and digital forensics.

• Demonstrated capacity to serve as Incident Commander within a team during high-pressure situations.

• Strong technical knowledge of Windows, Linux, and macOS internals pertinent to monitoring and threat detection.

• Experience with cloud security incident response and threat mitigation strategies.

• Proficient in malware analysis (both behavioral and static) as well as basic cryptanalysis.

• Knowledge of security frameworks and compliance standards (NIST, HIPAA, ISO, OWASP, etc.).

• Skilled in using DFIR tools such as Autopsy, The Sleuth Kit, Volatility, Magnet Axiom, FTK, among others.

• Competent in scripting languages such as Python, PowerShell, and Bash for automation and analysis purposes.

• Exceptional communication skills, with the ability to collaborate effectively across technical teams and stakeholders.

• Experience in the enterprise, manufacturing, or software sectors.

• Familiarity with SOAR platforms and security automation techniques.

• Previous experience in contributing to or enhancing incident response programs within a team environment.

🏝️ Benefits

• Join a talented, collaborative incident response team where your expertise contributes to collective success.

• Lead and assist in incident response initiatives alongside seasoned professionals.

• Continuously enhance your skills through varied investigations, threat hunting, and knowledge sharing within the team.

• Play a role in shaping and refining our incident response processes and training initiatives.