Principal Cybersecurity Incident Responder

This is a fully remote position, open to applicants in Michigan.

📋 Description

• Oversee the technical response to major and intricate cybersecurity incidents, guiding the process from initial investigation through to containment, eradication, and recovery.

• Set technical priorities, sustain progress, and make prompt, risk-informed decisions in the face of incomplete, conflicting, or rapidly evolving information.

• Collaborate with Investigations, Detection Engineering, Security Engineering, CTI, Threat Hunting, Forensics, Security Operations, and other teams to assess incident scope and coordinate response actions.

• Utilize knowledge of attacker tactics, techniques, and procedures to handle incidents involving identity compromise, ransomware, malware, cloud breaches, lateral movement, data exfiltration, and other advanced threats.

• Assess investigative findings, pinpoint critical gaps, test hypotheses, and convert evidence into strategies for containment, eradication, and recovery.

• Balance swift containment efforts with business impact, operational continuity, evidence preservation, and a comprehensive understanding of the incident's scope.

• Develop and enhance incident response playbooks, procedures, technical capabilities, exercises, telemetry, tools, automation, and lessons-learned processes.

• Design and conduct technical tabletop exercises and simulations.

• Identify gaps in telemetry, tools, access, and visibility, and collaborate with technical teams to strengthen detection and response capabilities.

• Utilize AI, automation, and orchestration while ensuring proper human oversight.

• Lead technical inputs for post-incident reviews and promote enhancements across telemetry, detections, tools, automation, procedures, and training.

• Act as a senior technical resource and mentor within the cybersecurity organization.

⛳️ Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Security, or a related field, or an equivalent combination of education and relevant professional experience.

• 8+ years of pertinent cybersecurity experience in incident response, digital forensics, threat hunting, security operations, security engineering, or related areas.

• Relevant industry certifications in incident response, digital forensics, security operations, cloud security, or other related cybersecurity fields are preferred.

• Proven experience leading technical responses to significant or complex cybersecurity incidents involving multiple technical teams and stakeholders.

• Extensive hands-on experience in investigating and responding to various sophisticated cyberattacks.

• Strong grasp of modern attacker tactics, techniques, and procedures.

• Broad technical expertise in endpoint, identity, network, cloud, email, and enterprise security technologies, including investigative telemetry.

• Demonstrated capability to evaluate evidence, test hypotheses, identify investigative gaps, and make sound decisions amidst incomplete or rapidly evolving information.

• Experience in developing or enhancing incident response playbooks, procedures, exercises, or operational capabilities.

• Ability to convey complex technical situations clearly and succinctly to technical responders, cybersecurity leadership, and non-technical stakeholders.

• Ability to coordinate and influence cross-functional technical teams without direct authority and operate effectively in a high-pressure, global environment.

• Preference for candidates based in Eastern or Central time zones.

• CISSP, GCIH, ECIH, OSIR, GCFA, GCFE, CHFI, CISM, or GSOC certifications are preferred.

🏝️ Benefits

• Flexibility for remote work.

• Opportunity for travel (20%).