Incident Response Lead

The Role

This senior GSOC position leads end-to-end technical response to complex cybersecurity incidents, coordinating containment, eradication and recovery activities. Day-to-day responsibilities include conducting host, network, cloud and identity investigations, performing digital forensic examinations with proper evidence handling, carrying out malware analysis, and producing high-quality technical reports and executive summaries for stakeholders.

Skills & Experience

Candidates need at least seven years in cybersecurity or incident response, with demonstrable experience leading enterprise IR engagements. Strong knowledge of the MITRE ATT&CK framework, Windows, Linux, Active Directory, Microsoft 365 and Azure is essential, alongside hands-on experience with SIEM, EDR/XDR, NDR and forensic investigation tooling. Malware analysis and basic reverse engineering skills are required.

Who It Suits

This role suits an experienced incident responder or DFIR professional ready to take a technical leadership position in a fast-paced global environment. Those who thrive on high-pressure, high-impact investigations, enjoy mentoring junior colleagues, and are comfortable participating in a 24/7 on-call rotation will find this role rewarding.