SalariesSign in
AboutPrivacyTerms
Incident Response Lead
Harbor IT

Incident Response Lead

United StatesRemoteFull-time
Pay Range: $105k - $135k / annual
Posted Oct 2
Apply

Job Description

Harbor IT is a national provider of managed IT, cybersecurity, AI, and cloud services, built for organizations running complex, regulated, and mission-critical environments. Harbor was formed by bringing together specialized technology firms rather than by acquiring generalists, which is why our engineering bench runs deeper across more domains than a typical managed service provider. Cybersecurity is not a product line we added. We started as a security company, and security is built into every service we deliver.

Our practices concentrate on industries where failure is not an option: critical infrastructure across oil and gas, agriculture, manufacturing, and transportation; multi-site healthcare and life sciences; and private equity portfolio companies and serial acquirers. We run a 24/7/365 Security Operations Center staffed entirely in the United States.

Our Managed Detection and Response practice, formerly Quadrant Information Security, combines security technology with in-house cybersecurity talent to deliver 24/7 monitoring, detection, and response across customer environments. The platform is built on Sagan, our proprietary detection and correlation engine.

This is a new role, and it exists because Harbor manages the systems attackers land in: email, identity, endpoints, servers, firewalls, backups, and the help desk that touches all of them. When a client is compromised we are the first call and the only party with hands already on the environment, but Harbor does not perform deep digital forensics and does not intend to. You will own the first hours instead: triage, scoping, containment decisions, straight answers for executives, and the judgment call about what Harbor handles end to end versus what gets handed to an outside DFIR firm, breach counsel, or an insurance panel. You are the incident commander, directing Harbor’s SOC analysts, security engineers, infrastructure teams, and help desk during a live event, and you will build the practice that supports it: the severity model, the playbooks, the escalation matrix, the client-facing report format, and the tabletops that test all of it before a real incident does. You report to the Senior Director of Cyber Services and work alongside the SOC Manager, the Director of Deployments and Engineering, Client Success, and the account teams who own the client relationship.

Key Responsibilities

Incident Command

  • Serve as incident commander for client security incidents: establish scope, set response priorities, assign actions to named owners, track decisions, and keep the incident moving when the environment is unfamiliar and the data is incomplete.
  • Run triage and initial investigation across the environments Harbor manages, including Microsoft 365 and Entra ID, Active Directory, endpoints under EDR, servers, firewalls, and the Sagan-based detection pipeline and its alert history. Often times delegating information gathering to internal resources while you focus on the things only you are capable of.
  • Own containment decisions and their consequences: what gets isolated, what credentials get reset, what gets left running to preserve evidence, and who at the client has authority to approve each one.
  • Make and defend the escalation call. Own the incidents that sit inside Harbor’s scope from detection through post-incident reporting, including business email compromise, single-host malware, and bounded credential compromise. When an incident exceeds that scope, brief the receiving DFIR firm and hand off with a written timeline and evidence inventory rather than a phone call and a shrug.
  • Carry on-call responsibility. Incidents do not respect business hours, and this role requires availability outside them.

Stakeholder Communication

  • Be the voice clients hear during the worst week of their year. Translate technical findings into decisions an owner, executive, or general counsel can act on, without overstating certainty and without hiding behind jargon.
  • Coordinate with breach counsel, cyber insurance carriers and their panel firms, third-party DFIR teams, client internal IT, and law enforcement where applicable, and keep Client Success and leadership current on active incidents.
  • Produce the post-incident report: what happened, what was confirmed versus assumed, what was contained, what remains open, and what the client should change.

Building the Practice

  • Write and maintain Harbor’s incident response playbooks, severity model, and escalation matrix, and define in writing where Harbor’s responsibility begins and ends so the boundary holds up in a contract and under pressure.
  • Build named working relationships with outside DFIR firms and breach counsel practices so handoffs start warm instead of starting with introductions.
  • Maintain an escalation-readiness record for every managed client: who holds an IR retainer, who holds cyber insurance and with which carrier, who has named counsel, and who has nothing.
  • (When applicable/feasible) Run tabletop exercises with Harbor teams and with clients, and turn what breaks in those exercises into playbook changes.
  • Mentor SOC analysts and security engineers on investigative method and incident discipline, and feed lessons from real incidents back to detection engineering so the same intrusion gets caught earlier next time.

Required Qualifications & Skills

Experience & Education

  • 6+ years in cybersecurity, with substantial time spent responding to real intrusions rather than monitoring for them.
  • Direct experience acting as the lead on security incidents, meaning you set the direction and other people executed against it. Participation on an IR team is not the same thing.
  • Experience responding across multiple distinct organizations, whether from a consulting, MSSP, MDR, or panel DFIR background. This role sees a different environment every time.

Technical Depth

  • Hands-on investigative depth in Microsoft 365, Google Workspace, and Entra ID compromise: unified audit log analysis, message trace, mailbox rules and forwarding, OAuth consent and application grants, device code and token abuse, and conditional access gaps.
  • Working command of endpoint detection and response tooling for investigation and containment, and enough host and Windows internals knowledge to interpret process lineage, persistence mechanisms, and lateral movement evidence.
  • Ability to build a defensible incident timeline from mixed and incomplete sources: SIEM and detection alerts, endpoint telemetry, cloud audit logs, firewall logs, and help desk tickets.
  • Practical understanding of ransomware and hands-on-keyboard intrusion tradecraft, sufficient to scope an incident correctly and to recognize immediately when it exceeds what Harbor should be handling.

Judgment & Communication

  • Demonstrated experience working alongside breach counsel, cyber insurance carriers, or third-party DFIR firms during a live incident, including handing off an investigation.
  • Ability to brief non-technical executives under pressure and to write clearly enough that a client can act on the document without a follow-up call.
  • Willingness and ability to be reachable outside business hours for incident escalation.

Preferred Qualifications & Skills

  • GCIH, GCFA, GCIA, or comparable GIAC certification. CISSP or CISM.
  • Prior experience at a panel DFIR firm, MDR provider, or MSSP incident response team.
  • Host and memory forensics depth, malware triage, or reverse engineering. Not required for this role, but useful for knowing what to ask an outside firm for.
  • Linux investigation experience, and cloud incident response beyond Microsoft such as AWS or Google Workspace.
  • Familiarity with regulatory and contractual notification obligations under HIPAA, PCI DSS, GLBA, state breach notification statutes, or SEC disclosure rules.
  • Background in managed services or another multi-tenant environment where you owned the relationship as well as the investigation.

Location & Work Model

Location: Remote (US)

Travel: None expected

Schedule: Standard business hours with on-call rotation and availability for incident escalation outside those hours.

Compensation & Benefits

  • Base salary: $105,000 to $135,000, depending on experience
  • Employer-paid medical, dental, and vision coverage for the employee, with additional premium plan options available

•401(k) with company match

•Paid time off

  • Reimbursement for approved tuition, certifications, and conference attendance

Equal Employment Opportunity

Harbor IT is an equal opportunity employer. We evaluate all qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other characteristic protected by applicable law. If you need a reasonable accommodation during the application or interview process, let us know and we will work with you.

Originally posted on Himalayas

View job

Cybersecurity Consultant – MS Copilot & Power Platform

Dragonfli Group

  • United States
  • Remote
  • Contract
Apply
Oct 2
View job

Senior Backend Engineer - Prompt Security (Node.js / TypeScript)

SentinelOne

  • United States
  • Remote
  • Full-time
Apply
Oct 2
View job

Senior Associate Cybersecurity Consultant

Acrisure

  • United States
  • Remote
  • Full-time
Apply
Oct 2
View job

Senior Security Risk Engineer

GitLab

  • Canada
  • Remote
  • Full-time
Apply
Oct 2
View job

Application Security Engineer

TripleTen

  • Slovakia
  • Remote
  • Full-time
Apply
Oct 2
View job

Senior Cybersecurity Analyst - (Cyber Defense Operations)

Talan

  • Spain
  • Remote
  • Full-time
Apply
Oct 2
View job

Senior Security Engineer - SecOps

Mozilla

  • Belgium
  • Remote
  • Full-time
Apply
Oct 2
View job

New Hire Compliance Manager

Sutherland

  • United States
  • Remote
  • Full-time
Apply
Oct 2
View job

Application Security Analyst

ASRC Federal

  • United States
  • Remote
  • Full-time
Apply
Oct 2
View job

Staff Cybersecurity Software & Systems Engineer (F/M/D) (CAMBRIDGE, SWD, GB, CB2

TE Connectivity

  • United Kingdom
  • Remote
  • Full-time
Apply
Oct 2
View job

Application Security Engineer

TripleTen

  • Croatia
  • Remote
  • Full-time
Apply
Oct 2
View job

Network Cloud Security Specialist

Neon

  • Brazil
  • Remote
  • Full-time
Apply
Oct 2
View job

Principal Cyber Threat Intelligence Analyst

Fifth Third Bank

  • United States
  • Remote
  • Full-time
Apply
Oct 2
View job

Cyber Security Analyst | Upto $2150 Part-time

mercor

  • India
  • Remote
  • Contract
Apply
Oct 2
View job

Staff Software Engineer — Identity & Access Management

Xsolla

  • Serbia
  • Remote
  • Full-time
Apply
Oct 2
View job

Senior Security Engineer

Anduril

  • United States
  • Remote
  • Full-time
Apply
Oct 2
View job

Senior Corporate Security Engineer

Mirantis

  • United States
  • Remote
  • Full-time
Apply
Oct 2
View job

DevSecOps Specialist - Fully Remote | Upto $77/hr

mercor

  • United States
  • Remote
  • Contract
Apply
Oct 2
View job

Application Security Engineer

TripleTen

  • Spain
  • Remote
  • Full-time
Apply
Oct 2
View job

Information Security Incident Response Manager (Remote, MEX, MX)

NTT DATA

  • Mexico
  • Remote
  • Full-time
Apply
Oct 2
View job
L

Security Consultant

Logicalis Spain

  • Spain
  • Remote
  • Full-time
Apply
Oct 2
View job

DevSecOps Engineer

Talan

  • Spain
  • Remote
  • Full-time
Apply
Oct 2
View job

Cyber Security Analyst | Upto $2150 Part-time

mercor

  • United States
  • Remote
  • Contract
Apply
Oct 2
View job

Cloud Security Engineer, U.S. Customs and Border Protection (CBP), Remote (East

BizFirst

  • United States
  • Remote
  • Full-time
Apply
Oct 2
View job

AI Safety Expert - Red Team

mercor

  • Indonesia
  • Remote
  • Contract
Apply
Oct 2
View job

C# + Cybersecurity Engineer

PradeepIT Consulting Services Pvt Ltd

  • United States
  • Remote
  • Contract
Apply
Oct 2
View job

SAP S/4HANA Defense & Security Functional Lead - SME

CSCI Consulting

  • United States
  • Remote
  • Full-time
Apply
Oct 2
View job

Incident Response Lead

Harbor IT

  • United States
  • Remote
  • Full-time
Apply
Oct 2
View job

Cybersecurity Specialist - AI Systems

mercor

  • Germany
  • Remote
  • Contract
Apply
Oct 1
View job

IT Operations & Security Lead - UK

Zen Educate

  • United Kingdom
  • Remote
  • Full-time
Apply
Oct 1
PreviousPage 80 of 127Next
Harbor IT

Incident Response Lead

United StatesRemoteFull-time
Pay Range: $105k - $135k / annual
Posted Oct 2
Apply

Job Description

Harbor IT is a national provider of managed IT, cybersecurity, AI, and cloud services, built for organizations running complex, regulated, and mission-critical environments. Harbor was formed by bringing together specialized technology firms rather than by acquiring generalists, which is why our engineering bench runs deeper across more domains than a typical managed service provider. Cybersecurity is not a product line we added. We started as a security company, and security is built into every service we deliver.

Our practices concentrate on industries where failure is not an option: critical infrastructure across oil and gas, agriculture, manufacturing, and transportation; multi-site healthcare and life sciences; and private equity portfolio companies and serial acquirers. We run a 24/7/365 Security Operations Center staffed entirely in the United States.

Our Managed Detection and Response practice, formerly Quadrant Information Security, combines security technology with in-house cybersecurity talent to deliver 24/7 monitoring, detection, and response across customer environments. The platform is built on Sagan, our proprietary detection and correlation engine.

This is a new role, and it exists because Harbor manages the systems attackers land in: email, identity, endpoints, servers, firewalls, backups, and the help desk that touches all of them. When a client is compromised we are the first call and the only party with hands already on the environment, but Harbor does not perform deep digital forensics and does not intend to. You will own the first hours instead: triage, scoping, containment decisions, straight answers for executives, and the judgment call about what Harbor handles end to end versus what gets handed to an outside DFIR firm, breach counsel, or an insurance panel. You are the incident commander, directing Harbor’s SOC analysts, security engineers, infrastructure teams, and help desk during a live event, and you will build the practice that supports it: the severity model, the playbooks, the escalation matrix, the client-facing report format, and the tabletops that test all of it before a real incident does. You report to the Senior Director of Cyber Services and work alongside the SOC Manager, the Director of Deployments and Engineering, Client Success, and the account teams who own the client relationship.

Key Responsibilities

Incident Command

  • Serve as incident commander for client security incidents: establish scope, set response priorities, assign actions to named owners, track decisions, and keep the incident moving when the environment is unfamiliar and the data is incomplete.
  • Run triage and initial investigation across the environments Harbor manages, including Microsoft 365 and Entra ID, Active Directory, endpoints under EDR, servers, firewalls, and the Sagan-based detection pipeline and its alert history. Often times delegating information gathering to internal resources while you focus on the things only you are capable of.
  • Own containment decisions and their consequences: what gets isolated, what credentials get reset, what gets left running to preserve evidence, and who at the client has authority to approve each one.
  • Make and defend the escalation call. Own the incidents that sit inside Harbor’s scope from detection through post-incident reporting, including business email compromise, single-host malware, and bounded credential compromise. When an incident exceeds that scope, brief the receiving DFIR firm and hand off with a written timeline and evidence inventory rather than a phone call and a shrug.
  • Carry on-call responsibility. Incidents do not respect business hours, and this role requires availability outside them.

Stakeholder Communication

  • Be the voice clients hear during the worst week of their year. Translate technical findings into decisions an owner, executive, or general counsel can act on, without overstating certainty and without hiding behind jargon.
  • Coordinate with breach counsel, cyber insurance carriers and their panel firms, third-party DFIR teams, client internal IT, and law enforcement where applicable, and keep Client Success and leadership current on active incidents.
  • Produce the post-incident report: what happened, what was confirmed versus assumed, what was contained, what remains open, and what the client should change.

Building the Practice

  • Write and maintain Harbor’s incident response playbooks, severity model, and escalation matrix, and define in writing where Harbor’s responsibility begins and ends so the boundary holds up in a contract and under pressure.
  • Build named working relationships with outside DFIR firms and breach counsel practices so handoffs start warm instead of starting with introductions.
  • Maintain an escalation-readiness record for every managed client: who holds an IR retainer, who holds cyber insurance and with which carrier, who has named counsel, and who has nothing.
  • (When applicable/feasible) Run tabletop exercises with Harbor teams and with clients, and turn what breaks in those exercises into playbook changes.
  • Mentor SOC analysts and security engineers on investigative method and incident discipline, and feed lessons from real incidents back to detection engineering so the same intrusion gets caught earlier next time.

Required Qualifications & Skills

Experience & Education

  • 6+ years in cybersecurity, with substantial time spent responding to real intrusions rather than monitoring for them.
  • Direct experience acting as the lead on security incidents, meaning you set the direction and other people executed against it. Participation on an IR team is not the same thing.
  • Experience responding across multiple distinct organizations, whether from a consulting, MSSP, MDR, or panel DFIR background. This role sees a different environment every time.

Technical Depth

  • Hands-on investigative depth in Microsoft 365, Google Workspace, and Entra ID compromise: unified audit log analysis, message trace, mailbox rules and forwarding, OAuth consent and application grants, device code and token abuse, and conditional access gaps.
  • Working command of endpoint detection and response tooling for investigation and containment, and enough host and Windows internals knowledge to interpret process lineage, persistence mechanisms, and lateral movement evidence.
  • Ability to build a defensible incident timeline from mixed and incomplete sources: SIEM and detection alerts, endpoint telemetry, cloud audit logs, firewall logs, and help desk tickets.
  • Practical understanding of ransomware and hands-on-keyboard intrusion tradecraft, sufficient to scope an incident correctly and to recognize immediately when it exceeds what Harbor should be handling.

Judgment & Communication

  • Demonstrated experience working alongside breach counsel, cyber insurance carriers, or third-party DFIR firms during a live incident, including handing off an investigation.
  • Ability to brief non-technical executives under pressure and to write clearly enough that a client can act on the document without a follow-up call.
  • Willingness and ability to be reachable outside business hours for incident escalation.

Preferred Qualifications & Skills

  • GCIH, GCFA, GCIA, or comparable GIAC certification. CISSP or CISM.
  • Prior experience at a panel DFIR firm, MDR provider, or MSSP incident response team.
  • Host and memory forensics depth, malware triage, or reverse engineering. Not required for this role, but useful for knowing what to ask an outside firm for.
  • Linux investigation experience, and cloud incident response beyond Microsoft such as AWS or Google Workspace.
  • Familiarity with regulatory and contractual notification obligations under HIPAA, PCI DSS, GLBA, state breach notification statutes, or SEC disclosure rules.
  • Background in managed services or another multi-tenant environment where you owned the relationship as well as the investigation.

Location & Work Model

Location: Remote (US)

Travel: None expected

Schedule: Standard business hours with on-call rotation and availability for incident escalation outside those hours.

Compensation & Benefits

  • Base salary: $105,000 to $135,000, depending on experience
  • Employer-paid medical, dental, and vision coverage for the employee, with additional premium plan options available

•401(k) with company match

•Paid time off

  • Reimbursement for approved tuition, certifications, and conference attendance

Equal Employment Opportunity

Harbor IT is an equal opportunity employer. We evaluate all qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other characteristic protected by applicable law. If you need a reasonable accommodation during the application or interview process, let us know and we will work with you.

Originally posted on Himalayas