Incident Response, Senior Associate

Huron is redefining what a global consulting organization can be. Advancing new ideas every day to build even stronger clients, individuals and communities. We’re helping our clients find new ways to drive growth, enhance business performance and sustain leadership in the markets they serve. And, we’re developing strategies and implementing solutions that enable the transformative change they need to own their future.

As a member of the Huron corporate team, you’ll help to evolve our business model to stay ahead of market forces, industry trends and client needs. Our accounting, finance, human resources, IT, legal, marketing and facilities management professionals work collaboratively to support Huron’s collective strategies and enable real transformation to produce sustainable business results.

Join our team and create your future.

Description

This individual is responsible for the technical execution of incident response: deep-dive triage of escalated alerts, evidence collection and analysis across a complex technical environment, scoping the extent of compromise, and recommending and supporting containment and eradication. The role produces the technical findings and timelines that drive decisions during an incident and the root cause analysis that follows it, working closely with the Incident Response Manager, who owns stakeholder coordination and executive reporting. Scope is response-focused, with periodic collaboration with the broader information security team to feed incident findings into threat hunting, detection engineering, and other program maturation. The role requires dynamic coverage with flexibility to work outside standard business hours when an active incident requires it, and the work demands analytical rigor under time pressure, disciplined evidence handling, and clear technical writing.

Key Responsibilities

Technical triage and investigation

· Perform deep-dive analysis of escalated alerts and suspected incidents across endpoint, identity, email, network, and cloud telemetry.

· Reconstruct attacker and user activity into a defensible timeline establishing what happened, when, and what was affected.

· Determine the scope of compromise, including affected accounts, systems, and data.

· Establish root cause and distinguish confirmed findings from assumptions in every write-up.

Containment, eradication, and recovery

· Recommend and support containment actions such as account disablement, host isolation, credential resets, and access revocation.

· Work with IT and platform owners to execute eradication and recovery steps with the least business disruption the situation allows.

· Validate that containment held and that no attacker access or persistence remains before an incident is closed.

· Capture technical remediation items and hand them to the Incident Response Manager for tracking to closure.

Forensics and evidence handling

· Collect and preserve digital evidence from endpoints, cloud services, and logs, following sound handling and chain-of-custody practice.

· Conduct host and log forensic analysis in support of security, HR, Legal, and privacy investigations.

· Analyze suspicious files, email, and indicators to determine intent and impact, engaging external specialists when depth exceeds internal capability.

· Produce clear technical reports that hold up to legal, regulatory, and audit scrutiny.

Response readiness and continuous improvement

· Maintain and improve technical response playbooks, tooling, and evidence collection procedures.

· Feed incident findings to the Lead Threat Hunter so hunting and detection coverage matures against what has actually occurred in the environment.

· Contribute the technical detail behind post-incident reviews, including what happened and what would have surfaced it sooner.

· Support tabletop and ransomware exercises, providing the technical realism these exercises depend on.

Qualifications

· 3 to 5+ years of hands-on experience in incident response, digital forensics, or security operations, preferably in a large company or consulting firm.

· Undergraduate degree, preferably in Information Security, Computer Science, Information Technology, or a related discipline.

· Demonstrated experience investigating security incidents end to end, from initial alert through root cause and closure.

· Working knowledge of attacker tradecraft and a common framework for describing it, along with the operating system, identity, and cloud internals needed to investigate it.

· Practical experience with endpoint detection and response tooling, log aggregation and SIEM query languages, and cloud audit logging.

· Strong technical writing skills, with the ability to produce an incident timeline and root cause analysis a non-specialist can follow.

· Ability to work calmly and methodically under time pressure, with flexibility to extend beyond scheduled hours when an active incident requires it.

· Willingness to work US business hours as needed, coordinating daily with a primarily US-based security team.

Preferred Skills

· Security certifications such as GCIH, GCFA, GCFE, GNFA, OSCP, or similar.

· Experience with digital forensics tooling, including memory and disk analysis.

· Scripting experience (e.g., Python, PowerShell, KQL) used to automate collection, parsing, and analysis.

· Exposure to malware triage or reverse engineering fundamentals.

· Experience supporting insider risk, DLP, or privacy investigations alongside external threat cases.

· Working knowledge of network protocols and traffic analysis, including the ability to interpret firewall, proxy, DNS, and VPN logs to trace activity across the environment.

· Familiarity with cloud platform architecture and native logging across at least one major provider (e.g., Azure, AWS, M365), spanning identity, storage, and workload telemetry, and how each is commonly abused.

· Understanding of application and web security fundamentals, including common vulnerability classes and how exploitation attempts present in application and access logs.

· Experience working across time zones with distributed, cross-functional teams, including US-based stakeholders.

· Analytical problem-solving skills, including the ability to synthesize technical evidence into a format that supports leadership decision-making.

Position Level

Country