Incident Response & Forensics Lead

Overview

In this senior, hands-on role you lead the investigation and response to security incidents, combining forensics, threat intelligence, and AI-enabled workflows. You own high-severity incidents end-to-end and shape our intelligence-driven IR capability. You will work with legal, privacy, and external partners, and coach the SOC team to raise overall capabilities. This role sits at the intersection of cutting-edge security practice and operational impact, in a culture committed to customer success and bold innovation.

Responsibilities

• Act as technical lead on highest-severity incidents, owning end-to-end investigations
• Perform digital forensic analysis across endpoints, servers, cloud, SaaS, and identity environments
• Apply intelligence-driven approaches to investigations to guide scoping and response
• Collaborate with legal, privacy, communications, and external IR partners
• Lead proactive threat hunting informed by findings and intelligence
• Produce internal threat reports and actionable intelligence for security teams
• Shape threat intelligence capabilities, requirements, and tooling
• Expand incident response playbooks, procedures, and evidence handling standards
• Coach SOC analysts through live investigations
• Develop AI-assisted workflows for evidence collection, enrichment, triage, and analysis, integrated with security tooling

Key requirements

• Extensive hands-on DFIR experience across hybrid, cloud, and SaaS environments
• Practical forensics across endpoint, memory, network, log, and cloud evidence; strong evidence handling
• Intelligence mindset to turn findings into actionable intelligence for hunting and detection
• Knowledge of intelligence fundamentals and models (Diamond Model, F3EAD)
• Familiarity with cybercrime underground and illicit marketplaces
• Experience leading hypothesis-driven threat hunting
• Hands-on experience using AI in security, with automation and integrations, plus scripting (Python)
• Good knowledge of SIEM, SOAR, and EDR/XDR platforms
• Strong understanding of attacker behavior and MITRE ATT&CK across enterprise, cloud, and SaaS
• Ability to communicate complex findings to executives and CISO-level stakeholders
• Calm, structured judgment under pressure and a drive to elevate the team
• Creative problem-solving
• Clear, concise communication
• Collaborative mindset
• Digital forensics
• Incident response
• Threat hunting

Report this job