Senior Incident Responder

This is a fully remote position, open to applicants in Singapore.

📋 Description

• Oversee end-to-end live incident response engagements, covering scoping, containment, evidence acquisition, forensic analysis, and final reporting.

• Conduct technical investigations across various environments, including Windows, Linux, macOS, and cloud platforms.

• Manage multiple simultaneous engagements while ensuring high quality of outcomes.

• Take responsibility for the chain of custody, evidence handling, deliverable quality, and client satisfaction.

• Participate in on-call triage for retainer and IR-1 activations.

• Provide initial containment advice promptly following triage discussions.

• Collaborate directly with clients to scope incidents and define plans, deliverables, and commercial terms.

• Act as the senior technical point of contact throughout the engagement process.

• Offer guidance on remediation, recovery, and system hardening.

• Recognize the need to involve legal, insurance, or specialist services when appropriate.

• Mentor junior responders by assigning tasks, reviewing their work, and coaching them on best practices and decision-making.

• Disseminate knowledge through write-ups, internal training sessions, walkthroughs, and mentorship.

• Lead delivery efforts through others while upholding technical quality.

• Contribute to the development of playbooks, tooling, automation, and methodologies.

• Integrate lessons learned from engagements back into practice.

• Embrace AI and automation to enhance efficiency and quality of work.

• Report to a Response Director.

⛳️ Requirements

• Minimum of 3 years of comprehensive DFIR case experience.

• Experience in client-facing incident response in consultancy, MSSP IR teams, or in-house CSIRTs, handling real incidents.

• Capability to lead investigations from start to finish across BEC, ransomware, data breaches, compromise assessments, insider threats, and digital forensics cases.

• Strong technical proficiency in Windows, Linux, and macOS environments.

• Comfort with at least one major cloud service provider, such as AWS, Azure/M365, or GCP.

• Proficient in scripting with Python, Bash, or PowerShell to create collection, parsing, or automation tools independently.

• Excellent written and spoken English communication skills.

• Ability to generate client deliverables, lead client meetings, and represent Blackpanda in high-pressure scenarios.

• Sound judgment in ambiguous situations and the ability to remain calm under pressure.

• Preferred qualifications include SANS/GIAC certifications such as GCFA, GCIH, GNFA, GCFR, or GREM; or CISSP/OSCP.

• Preferred experience with EDR, SIEM, and forensic tools.

• Preferred fluency in additional languages relevant to the market, such as Japanese, Mandarin, Cantonese, Korean, Bahasa Malaysia/Indonesia, or Tagalog.

• Preferred experience in mentoring or training junior responders.

• Preferred contributions to tooling, automation, methodologies, open-source projects, or internal enhancements.

• Ability to work reliably within Asia-Pacific and Japan business hours, approximately GMT+7 to GMT+10.

• Willingness to participate in the on-call response rotation.

• A secure, private workspace and stable, high-speed internet connection suitable for handling sensitive client evidence.

• Willingness to travel occasionally for on-site engagements and to attend the annual week-long Tribe Onsite event.

🏝️ Benefits

• 40 days of paid leave annually, including public holidays.

• A comprehensive corporate health plan that covers medical and dental expenses.

• Opportunities for travel between offices.

• Required participation in the annual week-long Tribe Onsite meet-up.

• A professional training budget of $5000 USD per year, subject to manager approval and a 12-month retention requirement.

• Competitive base salary with performance-based variable compensation linked to market outcomes.

• Equity participation in the growth of Blackpanda.

• Involvement in real engagements from day one, with a clear trajectory toward leading more complex cases, technical specialization, and broader team leadership.