{"id":584703,"url":"https://alion.io/job/anaplan-dev-threat-intelligence-lead","title":"Incident Response & Forensics Lead","company":{"id":7301,"name":"Anaplan","domain":"anaplan.com","url":"https://alion.io/company/anaplan","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":87,"open_postings":25,"ghost_share":0,"stale_share":0.52,"repost_share":0,"time_to_fill_p50_days":55,"computed_at":"2026-10-16T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":104000,"max_usd":182000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":20},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Diamond Model","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-08-24T08:59:11Z","employer_posted_date":"2026-10-08","last_verified_at":"2026-10-16T18:53:50Z","board_verified":true,"closed_at":null,"days_open":53,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":53},"description":"At Anaplan, we are a team of innovators focused on optimizing business decision-making through our leading AI-infused scenario planning and analysis platform so our customers can outpace their competition and the market.\nWhat unites Anaplanners across teams and geographies is our collective commitment to our customers’ success and to our Winning Culture.\nOur customers rank among the who’s who in the Fortune 50. Coca-Cola, LinkedIn, Adobe, LVMH and Bayer are just a few of the 2,400+ global companies who rely on our best-in-class platform.\nOur Winning Culture is the engine that drives our teams of innovators. We champion diversity of thought and ideas, we behave like leaders regardless of title, we are committed to achieving ambitious goals, and we love celebrating our wins - big and small.\nSupported by operating principles of being strategy-led, values -based and disciplined in execution, you’ll be inspired, connected, developed and rewarded here. Everything that makes you unique is welcome; join us and let’s build what’s next - together!\nRole Summary:\nAs Anaplan's Incident Response & Forensics Lead, you will lead and improve how we investigate, respond to, and learn from security incidents. This is a senior, hands-on role that combines deep digital forensics and incident response expertise with strong threat intelligence knowledge. You will lead complex investigations, perform forensic analysis, conduct threat hunting, and leverage intelligence to understand who we are up against and how they operate. \nYou'll help build a mature, intelligence-driven IR capability grounded in a clear understanding of who targets organisations like ours and how they operate, including state-sponsored actors, well-resourced criminal groups, and attackers making growing use of AI.\nYour Impact:\nAct as technical lead on our highest-severity incidents, owning the investigation end-to-end, from triage and scoping through containment, eradication, recovery, and post-incident review\nPerform digital forensic analysis across endpoints, servers, cloud, SaaS, and identity environments, preserving evidence and reconstructing attacker activity and timelines\nApply an intelligence-driven approach to investigations, using what you find to understand adversary tradecraft, likely objectives, and related activity, and using that understanding to guide scoping and response decisions\nWork alongside legal, privacy, and communications teams during major incidents, and with external incident response partners where needed\nLead proactive, hypothesis-led threat hunts informed by investigation findings, intelligence, and emerging tradecraft, and turn the results into tested, high-fidelity detections\nProduce internal threat reporting that translates what we're seeing in our environment, and across the threat landscape relevant to us, into clear assessments and actions for security teams and leadership\nShape our threat intelligence capability, including intelligence requirements and the sources and tooling that support them, keeping it directly connected to investigation, hunting, and detection work\nExpand incident response playbooks, forensic procedures, and evidence handling standards, raise the standard of how we run complex investigations, and coach SOC analysts through live investigations\nUse AI as a core part of how you work, building and applying AI-assisted workflows and automation for evidence collection, enrichment, triage, and analysis, and integrating them with our security tooling\nYour Skills:\nExtensive hands-on experience in digital forensics and incident response, including leading complex, high-severity investigations across hybrid, cloud, and SaaS environments\nPractical forensic skills across endpoint, memory, network, log, and cloud evidence, with a sound approach to evidence handling and chain of custody\nAn intelligence mindset developed through investigative work: you naturally ask who is behind activity, what they want, and what else they're likely to have done, and you can turn investigation findings into intelligence that drives hunting, detection, and reporting\nWorking knowledge of intelligence analysis fundamentals, such as intelligence requirements, structured analysis, confidence assessments, and models like the Diamond Model and F3EAD, and how they apply to incident response\nFamiliarity with the cybercrime underground, including how criminal forums and marketplaces, initial access brokers, and ransomware ecosystems operate. Experience safely operating and managing research personas is a strong plus\nExperience leading hypothesis-driven threat hunting and converting findings into detections\nDemonstrable, hands-on experience using AI in security work, such as building AI-assisted investigation or triage workflows, using LLMs to accelerate analysis, or developing automation and integrations, with a grounded view of where it helps and where it doesn't. Solid scripting ability (e.g. Python) to support this\nGood knowledge of SIEM, SOAR, and EDR/XDR platforms and how they support investigation, hunting, and response\nStrong understanding of attacker behaviour and the MITRE ATT&CK framework, particularly across enterprise, cloud, and SaaS environments\nAbility to explain complex technical findings clearly and concisely, in writing and in person, to executive audiences, including CISO-level stakeholders\nCalm, structured judgement during high-pressure incidents, with a drive to share knowledge and raise the capability of the wider team\nOur Commitment to Diversity, Equity, Inclusion and Belonging (DEIB)\nWe believe attracting and retaining the best talent and fostering an inclusive culture strengthens our business. DEIB improves our workforce, enhances trust with our partners and customers, and drives business success. Build your career in a place where diversity, equity, inclusion and belonging aren’t just words on paper - this is what drives our innovation, it’s how we connect, and it contributes to what makes us a market leader. We believe in a hiring and working environment where all people are respected and valued, regardless of gender identity or expression, sexual orientation, religion, ethnicity, age, neurodiversity, disability status, citizenship, or any other aspect which makes people unique. We hire you for who you are, and we want you to bring your authentic self to work every day!\nWe will ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application or interview process, perform essential job functions, and receive equitable benefits and all privileges of employment. Please contact us to request accommodation. \nFraud Recruitment Disclaimer \nIt has come to our attention that fraudulent and fictitious job opportunities are being circulated on the Internet. Prospective candidates are being contacted by certain individuals, mainly through telephone calls, emails and correspondence, claiming they are representatives of Anaplan. The main purpose of these correspondences and announcements is to obtain privileged information from individuals.\nAnaplan does not: \nExtend offers to candidates without an extensive interview process with a member of our recruitment team and a hiring manager via video or in person. \nSend job offers via email. All offers are first extended verbally by a member of our internal recruitment team whenever possible and then followed up via written communication. \nAll emails from Anaplan would come from an @anaplan.com email address. Should you have any doubts about the authenticity of an email, letter or telephone communication purportedly from, for, or on behalf of Anaplan, please send an email to  before taking any further action in relation to the correspondence. \nPrivacy & AINotice\nCandidate data processed during our recruitment activities is handled in accordance withour Candidate Privacy Notice. This may include the use of artificial intelligence or automated tools to assistour team in evaluating qualifications.","description_format":"text","description_chars":8033,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Artificial Intelligence","Professional Services","Supply Chain"],"lifecycle":[{"event":"open","at":"2026-09-10T02:09:07Z"}],"visa":[{"country":"GB","licensed_sponsor":true,"evidence":"Licensed UK visa sponsor (Senior or Specialist Worker, Skilled Worker)","filings_12m":null,"filings_prev_12m":null,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"Global Business Mobility: Senior or Specialist Worker; Skilled Worker","cap_exempt":false,"checked_at":"2026-10-16T06:21:30+00:00","sources":["UK Home Office: register of licensed sponsors (workers)"],"filings_for_role_12m":0}],"liveness":{"score":33,"band":"fade","label":"Fading","p_open":1,"p_active":0.544,"p_room":0.6,"age_days":52,"expected_fill_days":55,"reasons":["conf:0","stale_co","velocity","win:late","crowd:brand"],"computed_at":"2026-10-16T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/anaplan-dev-threat-intelligence-lead","json_url":"https://alion.io/job/anaplan-dev-threat-intelligence-lead.json","meta":{"generated_at":"2026-10-16T21:24:34Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2368,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-17T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":7301},"rest":"https://alion.io/mcp/rest/get_company?id=7301"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fanaplan-dev-threat-intelligence-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fanaplan-dev-threat-intelligence-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fanaplan-dev-threat-intelligence-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/anaplan-dev-threat-intelligence-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fanaplan-dev-threat-intelligence-lead"}]}