{"id":3263868,"url":"https://alion.io/job/sygnia-incident-response-expert","title":"Incident Response Expert","company":{"id":49152,"name":"Sygnia","domain":"sygnia.co","url":"https://alion.io/company/sygnia","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Comeet","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":116000,"max_usd":209000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":390},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Crowdstrike","optional":false},{"name":"DNS","optional":false},{"name":"EnCase","optional":false},{"name":"FTK","optional":false},{"name":"GCP","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Velociraptor","optional":false},{"name":"Windows","optional":false},{"name":"Wireshark","optional":false},{"name":"X-Ways Forensics","optional":false}],"status":"live","first_seen_at":"2026-10-26T07:28:52Z","employer_posted_date":"2026-10-26","last_verified_at":"2026-10-28T01:52:56Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Description\nAbout Sygnia\nSygnia is a premier cyber technology and services company providing high-impact incident response, cyber resilience consulting, and threat hunting for leading organizations across the globe. Trusted by Fortune 100 companies and government entities alike, Sygnia draws its strength from a team of elite professionals with backgrounds in military-grade cyber operations and the global cybersecurity industry.\nSygnia is rapidly expanding its presence in the United States, growing our incident response capabilities and client base across key industries. Joining now means playing a formative role in shaping our U.S. operations while benefiting from the backing and expertise of an established global leader.\nThe Role\nWe are seeking a highly skilled and motivated Incident Response Expert to join our elite global team. In this role, you will lead and participate in complex forensic investigations and incident response engagements involving sophisticated cyberattacks, ransomware events, and nation-state activity. Your expertise will play a critical role in helping Sygnia’s clients understand, contain, and recover from cyber incidents while preserving business continuity and mitigating risk.\nWhat You’ll Do\nWork with a team to conduct end-to-end forensic investigations, including log analysis, host and network forensics, malware triage, and memory analysis.\nSupport response efforts for major cybersecurity incidents, collaborating closely with internal and external security and IT teams.\nPerform threat hunting activities in client environments to detect and eliminate advanced persistent threats.\nIdentify Indicators of Compromise (IOCs) and attacker Tactics, Techniques, and Procedures (TTPs) using frameworks like MITRE ATT&CK.\nAnalyze a wide variety of data sources (endpoint, network, SIEM, etc.) to build a clear picture of the attacker’s actions and impact.\nLeverage and contribute to Sygnia’s internal investigation tools, playbooks, and threat intelligence platforms.\nCommunicate investigation results effectively to both technical stakeholders and executive leadership.\nDevelop and present high-quality technical reports, timelines, and strategic recommendations to clients.\nSupport the continuous improvement of internal methodologies, tooling, and knowledge sharing within the team.\nRequirements\nWhat We’re Looking For\n 3+ years of hands-on experience in incident response, digital forensics, threat hunting, or cyber investigations-whether from the private sector, military, or government.\nDeep technical understanding of operating systems (Windows, Linux, macOS), file systems, registry and memory structures, and log analysis.\nProficiency in network fundamentals and common protocols (DNS, HTTP/S, SMB, etc.) and network traffic analysis (e.g., PCAP review).\nExperience with tools such as EnCase, X-Ways, FTK, Velociraptor, Splunk, or Wireshark, and EDR platforms like CrowdStrike, SentinelOne, or Microsoft Defender.\nCompetency in scripting or automation (e.g., Python, PowerShell) to support investigations.\nFamiliarity with cloud environments (AWS, Azure, GCP) and related forensic techniques is a plus.\nExcellent written and verbal communication skills; able to clearly convey complex technical topics to diverse audiences.\nStrong analytical thinking, attention to detail, and ability to work under pressure in time-sensitive environments.\nWillingness to travel.\nBonus Points For\nIndustry-recognized certifications (e.g., GCFA, GCIH, GNFA, GCIA, GREM, CISSP).\nExperience responding to ransomware, business email compromise (BEC), and advanced threat actor incidents.\nExperience presenting findings to legal counsel, regulators, or board-level stakeholders.\nMultilingual skills and experience in multinational or cross-cultural environments.\nA degree in Computer Science, Information Security, or a related field; or equivalent education or training in cybersecurity\nWhy Sygnia\nBe part of Sygnia’s continued growth in the U.S., with opportunities to influence how we scale our team, capabilities, and operations in a rapidly expanding market.\nWork with some of the best minds in cybersecurity on the world’s most high-impact cases.\nOperate in a fast-paced, elite-tier environment where your technical expertise is trusted and valued.\nTake part in meaningful, challenging work that directly shapes the outcomes for Fortune 500 organizations.\nGrow your career while staying hands-on in incident response and mentoring a highly capable team.","description_format":"text","description_chars":4489,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Cybersecurity","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-26T07:36:15Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":30,"reasons":["conf:2","win:early"],"computed_at":"2026-10-27T05:46:45Z"},"pay":null,"html_url":"https://alion.io/job/sygnia-incident-response-expert","json_url":"https://alion.io/job/sygnia-incident-response-expert.json","meta":{"generated_at":"2026-10-28T04:49:00Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6246,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-29T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":49152},"rest":"https://alion.io/mcp/rest/get_company?id=49152"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsygnia-incident-response-expert"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsygnia-incident-response-expert"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsygnia-incident-response-expert"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sygnia-incident-response-expert\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsygnia-incident-response-expert"}]}