Lead security investigations across endpoint, identity systems, cloud environments, and production workloads, covering triage, root-cause analysis, containment, and eradication.

Act as incident commander in your region, coordinating parallel work across IT, Engineering, Legal, HR, and other teams.

Investigate cases with no existing playbook: decide what data to collect, build the tools to analyze it, and document it for reuse.

Write and peer-review case summaries, incident reports, and timelines.

Hunt for novel threats, such as AI-assisted intrusions or supply-chain compromise. Convert findings into telemetry, detections, and automation that raise alert quality and reduce manual work.

Drive post-incident hardening with Security Engineering and mentor analysts through case review, escalation support, and knowledge sharing.

At least 6 years in cybersecurity, including 4 or more years in incident response, forensics, threat intelligence, or threat hunting.

Experience running major incidents with little supervision, under time pressure and incomplete facts, including briefing leadership and writing the post-incident reports for both engineers and executives.

Deep knowledge of how attackers operate today, including insider threat, and the frameworks such as MITRE ATT&CK, the Diamond Model, the kill chain, with the ability to assess an attacker’s capabilities as an investigation unfolds..

Hands-on experience with SIEM, EDR/NDR, and CSPM tooling.

Monitoring experience in endpoint, identity, SaaS or CI/CD environments, including incident investigation in at least one major cloud environment, such as AWS, Azure, or GCP.

Practical scripting skills in Python, PowerShell or a similar language, with experience utilizing YARA-L, Sigma, KQL, SPL or similar for investigation queries and detections.

Lead security investigations across endpoint, identity systems, cloud environments, and production workloads, covering triage, root-cause analysis, containment, and eradication.

Act as incident commander in your region, coordinating parallel work across IT, Engineering, Legal, HR, and other teams.

Investigate cases with no existing playbook: decide what data to collect, build the tools to analyze it, and document it for reuse.

Write and peer-review case summaries, incident reports, and timelines.

Hunt for novel threats, such as AI-assisted intrusions or supply-chain compromise. Convert findings into telemetry, detections, and automation that raise alert quality and reduce manual work.

Drive post-incident hardening with Security Engineering and mentor analysts through case review, escalation support, and knowledge sharing.

At least 6 years in cybersecurity, including 4 or more years in incident response, forensics, threat intelligence, or threat hunting.

Experience running major incidents with little supervision, under time pressure and incomplete facts, including briefing leadership and writing the post-incident reports for both engineers and executives.

Deep knowledge of how attackers operate today, including insider threat, and the frameworks such as MITRE ATT&CK, the Diamond Model, the kill chain, with the ability to assess an attacker’s capabilities as an investigation unfolds..

Hands-on experience with SIEM, EDR/NDR, and CSPM tooling.

Monitoring experience in endpoint, identity, SaaS or CI/CD environments, including incident investigation in at least one major cloud environment, such as AWS, Azure, or GCP.

Practical scripting skills in Python, PowerShell or a similar language, with experience utilizing YARA-L, Sigma, KQL, SPL or similar for investigation queries and detections.