Principal Incident Response Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Act as the primary escalation point and lead investigator for intricate, high-severity, and innovative security incidents.

• Triage, investigate, contain, eliminate, and recover from incidents across endpoint, network, cloud, identity, and application layers.

• Direct forensic investigations and reconstruct timelines of attacks.

• Convert investigation findings into both technical and executive-level narratives.

• Manage and enhance incident response processes, documentation, and playbooks.

• Facilitate root cause analyses and conduct post-incident reviews.

• Coordinate major incidents across IT, legal, compliance, and executive leadership teams.

• Guide incident responders and SOC analysts during real-time incidents.

• Participate in or lead on-call rotations for critical incident responses.

• Write, refine, and validate SIEM/NG-SIEM detection content.

• Ensure MITRE ATT&CK coverage and perform gap analyses.

• Conduct proactive, hypothesis-driven threat hunts.

• Utilize hunt results to identify compromises and enhance detection coverage.

• Collaborate with threat intelligence sources and feeds.

• Represent incident response in strategic planning, tabletop exercises, and architecture reviews.

• Lead intricate incident-related investigations and initiatives.

• Collaborate with cloud, network, and identity teams to bridge visibility and telemetry gaps.

• Convey findings and recommendations to both technical and non-technical stakeholders.

• Develop and uphold incident response procedure and policy documentation.

⛳️ Requirements

• Bachelor’s degree in a technical discipline or equivalent professional experience.

• Over 7 years of practical information security experience.

• Extensive subject-matter expertise in incident response, along with strong proficiency in detection engineering and threat hunting.

• Proven ability to independently manage complex, high-severity security incidents from detection through recovery.

• Experience in mentoring or providing technical guidance to security engineers and analysts.

• Exceptional written and verbal communication skills.

• In-depth hands-on expertise in comprehensive incident response, including triage, containment, eradication, recovery, and root cause analysis.

• Advanced digital forensics skills across endpoint, network, cloud, and identity sources, including memory and disk forensics.

• Significant experience with EDR/XDR platforms and log analysis.

• Strong knowledge of detection engineering and SIEM/NG-SIEM platforms such as CrowdStrike NG-SIEM, Splunk, or Microsoft Sentinel.

• Proficient in hypothesis-driven threat hunting.

• Extensive familiarity with the MITRE ATT&CK framework.

• Strong scripting or automation skills with Python, PowerShell, or similar, and/or experience utilizing LLM coding tools.

• Solid understanding of networking, AWS, Azure, GCP, Windows/Linux systems, and identity platforms.

• Knowledge of PCI-DSS or a similar compliance framework.

• Capability to lead high-pressure, ambiguous, cross-functional investigations with minimal supervision.

• Relevant practical experience and subject-matter expertise are prioritized over certifications.

• North is a US-based company; sponsorship is not available.

🏝️ Benefits

• Comprehensive total rewards offerings.

• Benefits that support overall well-being.

• Unique initiatives for personal and professional fulfillment.

• An inclusive work environment.

• Commitment to equal opportunity employment.