Incident Response Analyst

• Conduct investigations into a variety of malicious activity on workstations, servers, and in the cloud.
• Investigate all levels of incidents, including Incident Response engagements.
• Own complex investigations that may need various levels of delegation, customer communication, documentation, and collaboration across teams.
• Be an escalation point for complex and advanced incidents.
• Prepare Incident Reports for each minor incident investigation you complete.
• Communicate with other analysts to share new intelligence regarding tactics, techniques, and trends utilized by threat actors.

Incident Handler

• Serve as a member of the ITSM Service Now Incident Response team as an Analyst supporting the Incident Response Management team
• Support and respond to incidents working with the the Service Desk and Desktop support teams
• Oversee incident documentation, ensuring accuracy within RCA (Root cause analysis) and undertake an immediate effort to restore a failed IT application
• Assist with managing critical events, facilitating triage calls to engage technical support teams, coordinating service restoration activities, and communicating all relevant details to key business and client stakeholders
• Ensuring that our ITIL aligned Incident Management processes are followed so that event management is consistent throughout the organization & the Incident lifecycle
• Documenting all details related to Major Incidents; persons & teams engaged, service restoration activities, associated results, root cause results, preventative action items, for Problem Management

ITSM Incident Response Analyst

• Monitor and respond to cybersecurity alerts generated from SIEM provider dashboards and security monitoring platforms.
• Investigate, remediate, and document security incidents reported through automated alerts, tickets, emails, phone calls, or external SOC notifications.
• Act as the primary investigator for potential security incidents identified by SOC analysts or monitoring tools.
• Follow documented incident response playbooks while exercising sound judgment to contain and remediate threats.
• Investigate phishing emails, user‑reported security concerns, and potential attempts at fraud or financial loss.

Technical Incident Response Analyst

• Utilize security tools to analyze, investigate, and triage security alerts
• Monitor our customers environments, including cloud and SaaS solutions for evidence of adversarial activity
• Perform in-depth analysis and investigation of high-priority cybersecurity incidents
• Utilize advanced tools, such as host based digital forensics or malware analysis capabilities, to identify incidents’ root causes, scope, and impact
• Collaborate with cyber threat hunting and cyber threat intelligence teams
• Participate in the development, implementation, and tuning of the SOC tools detection content and alerting signatures
• Accurately document triage findings
• Learn new open and closed-source investigative techniques
• Perform research into emerging threats and vulnerabilities to aid their prevention and mitigation
• Help shape the evolution of processes and procedures of the SOC
• Provide guidance and mentorship to Tier 1 SOC Analysts to enhance their skills and capabilities

Part-Time Tier 2 Incident Response Analyst – Weekend Nights

• Perform penetration testing activities
• Supervise, develop, and coach teams
• Manage client service accounts
• Solve and analyze complex problems
• Deliver elevated-quality deliverables
• Lead and execute stealthy penetration testing

Cyber Incident Response Manager

• Lead a team of cyber security incident response and threat mitigation engineering professionals
• Be responsible for planning, design, operating Guardian’s cyber incident response and cyber threat mitigations operations across the areas
• Run our Corporate Incident Response Team as related to cybersecurity – coordinating actions and responses across teams
• Manage the plans, playbooks, quick reference guides necessary – and out-of-band communication plans
• Engage with 1st line teams to develop muscle memory and ensure containment actions (shutdown authorities are clear)
• Coordinate with business continuity/disaster recovery teams to ensure integrated approach to large events
• Be responsible for triaging & leading cyber security incidents advanced from the security operations center
• Manage third-party incident retainers and prepare for any future engagements
• Participate-in / coordinate periodic exercises with third-parties
• Ensure quality of security incident handling and cyber threat mitigation work
• Ensure incidents are appropriately tracked, reported and after-action reports documented
• Ensure metrics are timely and accurate
• Drive our user behavior analytics (UBA) program working with the business to develop and improve appropriate logging monitoring
• Develop standard operating procedures for our 1st line SOC based on threats/observed incidents
• Proactively identify gaps and opportunities in our logging and monitoring processes
• Host monthly incident response calibration/collaboration meetings across HR, physical security, fraud, legal, compliance to collaborate on issues and shared threats and knowledge
• Communicate to various levels of the organization, both written and oral concisely and clearly
• Provide strong technical understanding of security control monitoring process at different layers
• Identify (and champion where applicable) risk mitigation
• Collaborate with other leaders across cybersecurity to help define and complete cybersecurity strategy, financial, vendor and talent management
• Contribute to the enterprise organizational Data Loss Prevention program
• Lead, manage, guide, and mentor the staff on a regular basis, including selection/retention, goal setting, annual reviews, and compensation planning and career development
• Provide recommendations to management & leadership team to increase effectiveness of security technology solutions to mitigate cyber threats and handle incidents
• Respond to and assist with due diligence and internal / external security audit requests
• Identify and act on opportunities to further enhance and refine security incident handling & cyber threat mitigation processes & capabilities.

Head of Cyber Incident Response, Cyber Threat Mitigation Services

• Lead end-to-end incident response engagements within customer environments, driving rapid investigation, containment, and remediation of active threats
• Conduct deep-dive forensic and malware analysis to uncover adversary tactics, techniques, and procedures (TTPs), translating findings into actionable intelligence
• Proactively hunt for advanced threats through hypothesis-driven threat hunting across diverse data sources and telemetry
• Triage and validate suspicious activity using a combination of open-source intelligence (OSINT), proprietary intelligence, and behavioral analysis
• Own the documentation of incidents, ensuring clear, defensible reporting and timeline reconstruction within case management systems
• Identify and operationalize new adversary techniques, tools, and tradecraft—scaling knowledge across the team to strengthen collective defense
• Maintain a constant pulse on the evolving threat landscape, applying emerging intelligence to real-world investigations
• Surface visibility gaps in logging, telemetry, and detection coverage, and partner with stakeholders to enhance overall security posture
• Collaborate cross-functionally to develop and refine detection content, response playbooks, and threat intelligence outputs
• Serve as a trusted advisor to customers, confidently guiding them through the full incident response lifecycle—from initial compromise to full remediation and recovery

• Utilize security tools to analyze, investigate, and triage security alerts
• Monitor our customers environments, including cloud and SaaS solutions for evidence of adversarial activity
• Perform in-depth analysis and investigation of high-priority cybersecurity incidents
• Utilize advanced tools, such as host based digital forensics or malware analysis capabilities, to identify incidents’ root causes, scope, and impact
• Collaborate with cyber threat hunting and cyber threat intelligence teams
• Participate in the development, implementation, and tuning of the SOC tools detection content and alerting signatures.
• Accurately document triage findings, and intake reports of external cybersecurity events from SOC customers via phone or email in the SOCs Incident Management System(IMS)
• Learn new open and closed-source investigative techniques
• Perform research into emerging threats and vulnerabilities to aid their prevention and mitigation
• Help shape the evolution of processes and procedures of the SOC
• Provide guidance and mentorship to Tier 1 SOC Analysts to enhance their skills and capabilities

Tier 2 Incident Response Analyst

• Lead a cyber threat management team; set clear priorities and define actionable plans, ensuring alignment with organizational goals
• Guide team members through complex challenges, fostering their growth and development while maintaining a focus on high-impact results
• Recognized as a cyber threat management expert, independently resolving the most complex challenges, and providing strategic direction on problem resolution across the security domain
• Define methods and procedures for new or special assignments, collaborating with cross-functional teams to drive security initiatives that align with business needs and objectives
• Lead complex, high-impact security projects of diverse scope, applying an in-depth understanding of business trends and security challenges to develop innovative solutions that strengthen threat management and overall security posture
• Possess a keen awareness of the broader impact of decisions, with initiatives often leading to enterprise-wide improvements that enhance security practices, operational efficiency and organizational resilience
• act as incident commander for critical events, and ensure investigations meet regulatory and evidentiary standards
• translate threats into executive-level risk insights, drive post-incident improvements, and help PayPal stay ahead of evolving threats

Senior Manager, Cyber Incident Response – Threat Management

• Analyze complex cybersecurity problems to manage workstreams and develop deliverables
• Guide and mentor junior team members
• Build and sustain meaningful client relationships to drive engagement
• Work with team members to enhance operational effectiveness
• Uphold the firm's ethical standards and compliance requirements
• Analyze data to inform decision-making and improve outcomes

See all jobs on JobTailor