Incident Responder

Security Operations Remote (US) / Catonsville, MD Full-Time $100K–$145K DOE

SOClogix is seeking an experienced Incident Responder to lead and execute cybersecurity incident investigations for our managed security clients. You'll be the frontline defender when a breach occurs - conducting triage, containment, eradication, and recovery operations while coordinating with client IT teams and, when necessary, law enforcement. This is a high-impact role that requires composure under pressure, deep technical skills, and the ability to communicate clearly with both technical staff and executive stakeholders.

• Lead incident response engagements from initial triage through full remediation and post-incident review
• Perform digital forensic analysis across endpoints, servers, cloud environments, and network infrastructure
• Conduct malware analysis, memory forensics, and log analysis to determine scope, root cause, and impact
• Contain active threats including ransomware, business email compromise, data exfiltration, and insider threats
• Develop and deliver incident reports with timelines, technical findings, executive summaries, and remediation recommendations
• Coordinate with client IT teams, legal counsel, insurance carriers, and law enforcement as needed
• Build and maintain incident response playbooks, runbooks, and escalation procedures
• Conduct post-incident lessons learned and help clients strengthen their security posture
• Participate in on-call rotation for emergency incident response (24/7 coverage)

• 3+ years of experience in incident response, digital forensics, or security operations
• Hands-on experience with forensic tools:
  Velociraptor, KAPE, FTK, Autopsy, X-Ways, or similar
• Strong knowledge of Windows and Linux forensic artifacts (event logs, registry, prefetch, $MFT, syslog)
• Experience investigating ransomware incidents, BEC, lateral movement, and data exfiltration
• Proficiency with SIEM platforms (Open Search, Splunk, Sentinel, or similar) and EDR tools (Lima Charlie, Crowd Strike, Sentinel One)
• Understanding of MITRE ATT&CK framework and how to apply it to real-world investigations
• Strong written and verbal communication skills - ability to brief executives and write professional reports
• At least one relevant certification: GCIH, GCFA, GCFE, GREM, EnCE, or equivalent

• GCFA, GNFA, or GREM certification
• Experience with cloud incident response (Azure AD, M365, AWS Cloud Trail)
• Experience working with cyber insurance carriers and breach coaches
• Scripting skills (Python, Power Shell) for automation and custom tooling
• Previous MSSP or consulting IR experience
• Competitive salary based on experience
• Health, dental, and vision insurance
• 401(k) with company match
• Unlimited PTO
• Annual certification and training budget
• Remote-first culture with flexible scheduling
• Paid on-call compensation
• Access to forensic lab and investigation tools