SOC Incident Responder

Qualifications :

• Minimum of 4–6+ years of technical cybersecurity experience, with at least 2–3 years entirely dedicated to Digital Forensics and Incident Response (DFIR) or active cyber-crisis management.
• Proven experience serving as a primary responder handling major security threats (e.g., enterprise ransomware staging, data exfiltration, business email compromise, cloud tenancies hijacking).
• Preferred Professional Certifications.
• Candidates holding one or more of the following advanced technical designations will be highly prioritized:
• Incident Handling & Defense :

○ GIAC Certified Incident Handler ( GCIH )

○ GIAC Certified Detection Analyst ( GCDA )

• Digital Forensics :

○ GIAC Certified Forensic Analyst ( GCFA )

○ GIAC Certified Forensic Examiner ( GCFE )

○ Certified Computer Security Incident Handler ( CSIH)

Responsibilities :

Live Incident Containment & Eradication

• Assume active command of security incidents from initial confirmation through successful remediation, driving rapid-containment playbooks under extreme time pressure.
• Formulate and execute highly targeted eradication plans, removing web shells, malicious persistence mechanisms, rogue administrative accounts, and malware payloads.
• Partner directly with IT Infrastructure and Disaster Recovery teams to guide the safe, verified restoration of business systems following a breach.

Host, Cloud, & Network Forensics

• Perform live-state memory captures, extract Master File Tables (MFT), and collect forensic system artifacts across Windows, Linux, and macOS endpoints using enterprise tools.
• Reconstruct complex, multi-stage attack timelines by correlating telemetry across cloud infrastructure (AWS/Azure/GCP), local identity nodes, network firewall pipes, and application layers.
• Conduct behavioral malware analysis to quickly isolate Indicators of Compromise (IoCs), identify command-and-control (C2) servers, and decipher attacker capabilities.

Governance, Playbooks, & Post-Mortem

• Author detailed Root Cause Analysis (RCA) records and Post-Incident Reports (PIR) for executive leadership and compliance auditors.
• Convert findings from active breaches into automated incident response playbooks within the corporate SOAR platform.
• Maintain pristine evidentiary standards and strict chain-of-custody documentation to support potential regulatory disclosures, insurance claims, or legal actions

Work Location: In person