Job Description Summary

As a Staff Incident Responder, you will be a senior technical member of a global, follow-the-sun incident response team, accountable for investigating and responding to cybersecurity incidents across endpoint, network, identity, cloud, and SaaS environments.

You will handle incidents from initial triage through containment, eradication, recovery, and lessons learned, and participate in on-call and major-incident rotations.

In this role, you will operate with minimal direction, exercise sound judgment under time pressure and with incomplete information and recognize when escalation is required. You will also be a visible partner to teams outside Security, clearly explaining risks and influencing outcomes.

As a Staff Incident Responder, you will serve as a technical escalation point, mentor other responders, and maintain proficiency in modern adversary tradecraft, including the malicious use of AI and automation. You will apply that expertise to strengthen detections, improve playbooks and response tooling, automate repeatable tasks, and translate lessons learned into measurable improvements in the organization’s detection and response capabilities.

Job Description

Responsibilities

In this role, you will:

• Conducting incident response across incidents of varying types and severities, using EDR, SIEM, cloud security, identity, email, network, and other investigative tooling throughout triage, containment, eradication, and recovery.

• Producing clear, timely investigation records, technical findings, incident reports, and stakeholder updates that document scope, impact, decisions, actions, and remaining risk.

• Serving as a technical escalation point and, when assigned, incident commander for high-severity and complex incidents, driving investigation strategy and coordinating technical and nontechnical stakeholders. 

• Performing deep technical analysis to reconstruct attacker activity, identify tactics, techniques, and procedures, determine root cause and impact, and assess attribution when supported by sufficient evidence.

• Developing containment, eradication, and recovery strategies in partnership with IT, Cloud, Application, Identity, Legal, Privacy, Communications, and business leaders, restoring operations without unnecessarily destroying evidence or leaving the adversary with continued access.

• Conducting threat hunts and translate findings from incidents and emerging threats into new or improved detections, reduced false positives, stronger controls, and more effective response workflows.

• Driving security-hardening initiatives based on incident root-cause analysis and track corrective actions through validation and closure.

• Evaluating and responsibly apply AI-assisted and agentic capabilities to improve incident triage, investigation, detection, and response workflows, with appropriate human oversight and validation.

• Continuously improving incident-response playbooks, procedures, tooling, automation, and forensic capabilities using lessons learned from incidents, exercises, and post-incident reviews.

• Mentoring responders, share technical knowledge, and promote consistent investigative practices and decision-making across the global CIRT.

• Participating in a rotating on-call schedule, including response outside normal business hours during significant incidents, and provide complete follow-the-sun handoffs across regions.

• Bachelor’s degree in Computer Science, Cybersecurity, a related field, or equivalent practical experience.

• Demonstrable hands-on experience in security operations or incident response, with a track record of owning high-impact incidents end to end and coordinating across technical and business stakeholders.

• Demonstrated ability to independently prioritize and complete multiple tasks with little to no supervision.

• Willingness and ability to participate in a rotating on-call schedule, including occasional after-hours, weekend, and holiday response during significant incidents.

• Strong verbal and written communication skills, including the ability to explain technical risk to non-technical stakeholders.

#LI-MT1

#LI-Hybrid

Additional Information