Senior Incident Response Analyst

Role Overview We are seeking a highly skilled and proactive Senior Incident Response Analyst to join our security operations function. In this role, you will lead and support the detection, investigation, containment, and remediation of security incidents across enterprise and cloud environments. You will work closely with SOC analysts, threat intelligence, engineering, IT, legal, privacy, and business stakeholders to ensure timely and effective response to threats while strengthening the organization’s overall security posture. This role requires strong technical depth, sound incident handling judgment, and the ability to operate calmly under pressure in high-impact security situations.

Key

Responsibilities Lead end-to-end incident response activities, including triage, investigation, containment, eradication, and recovery. Analyze security alerts, logs, telemetry, endpoint artifacts, network traffic, cloud audit trails, and identity events to determine impact and scope. Perform root cause analysis and produce clear incident reports with actionable remediation recommendations. Coordinate incident handling across teams such as SOC, infrastructure, cloud, application, identity, and legal/compliance. Support forensics and evidence preservation activities while maintaining chain-of-custody practices. Develop and improve incident response playbooks, SOPs, escalation workflows, and response standards. Identify attack patterns, adversary behaviors, and control gaps using threat intelligence and detection engineering techniques. Collaborate with engineering teams to improve detection coverage, alert fidelity, and response automation. Lead post-incident reviews and drive corrective actions to reduce repeat incidents and business risk. Participate in on-call rotation and support major security incidents when required. Mentor junior analysts and contribute to knowledge sharing and operational maturity. Required

Qualifications Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent practical experience. 5 to 8 years of experience in cybersecurity, with significant exposure to incident response, SOC operations, digital forensics, or security engineering. Strong hands-on experience in investigating endpoint, email, identity, cloud, and network security incidents. Solid understanding of attacker techniques, MITRE ATT&CK, malware behavior, privilege escalation, lateral movement, and persistence methods. Proficiency in analyzing logs and telemetry from tools such as SIEM, EDR/XDR, IDS/IPS, firewalls, proxy, IAM, cloud security platforms, and DLP systems. Experience with Windows and Linux environments, including command-line analysis and basic scripting. Familiarity with cloud platforms such as Azure, AWS, or GCP. Strong report writing, communication, and stakeholder management skills. Ability to work independently, prioritize under pressure, and make sound decisions during active incidents. Certifications such as GCIH, GCFA, GCFE, CEH, Security+, Azure Security Engineer, or equivalent. Experience with incident response automation, SOAR, or scripting using Python, PowerShell, Bash, or similar. Exposure to malware analysis, memory analysis, forensic tooling, or reverse engineering concepts. Experience supporting regulated environments such as financial services, healthcare, enterprise SaaS, or large-scale cloud deployments. Familiarity with Zero Trust, identity security, container security, and modern detection engineering practices. Experience working in high-scale or globally distributed environments. Core Competencies Strong analytical and investigative mindset High sense of ownership and accountability Clear written and verbal communication Ability to remain effective during high-severity incidents Collaboration across technical and non-technical teams Attention to detail and evidence-based decision making Continuous improvement and process discipline Participation in on-call rotation, flexible working hours & travel to client location, off-hours support for critical incidents. Comfortable operating in a fast-paced, collaborative, and security-sensitive environment.