Cyber Incident Response Analyst II

Overview

The Cyber Security Incident Response II is responsible for detecting, analyzing, investigating, and responding to cybersecurity threats and incidents across the enterprise. This role performs advanced threat detection, incident triage, forensic analysis, containment, and recovery activities coordinated across internal and external stakeholders.

The Cyber Security Incident Response II is responsible for detecting, analyzing, investigating, and responding to cybersecurity threats and incidents across the enterprise. This role performs advanced threat detection, incident triage, forensic analysis, containment, and recovery activities coordinated across internal and external stakeholders. The ideal candidate possesses a strong foundation in cyber security incident response, digital forensics, detection capabilities, and stakeholder engagement.

This position requires the ability to independently manage complex cybersecurity incidents, collaborate effectively with business and technical teams, influence decision-making through risk-based recommendations, and perform successfully in time-sensitive and high-pressure environments.

This role partners with third-party service providers, vendors, infrastructure teams, and security engineering and architecture teams to strengthen the organization's security posture and improve incident response capabilities. The candidate will maintain a strong understanding of AmTrust's mission, vision, and values while upholding the highest standards of professionalism and service.

• Investigate security alerts, suspicious activity, and cybersecurity incidents to determine scope, impact, root cause, and remediation actions.
• Lead the analysis and response efforts for medium- to high-complexity security incidents, ensuring timely containment, eradication, recovery, and documentation.
• Perform digital forensics, log analysis, artifact collection and preservation, and host and network investigations using enterprise security monitoring and endpoint detection tools.
• Analyze indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs), and threat intelligence to support investigations.
• Utilize SIEM, EDR, threat intelligence, cloud security, and case management platforms to investigate and respond to security incidents.
• Develop and maintain detection logic, correlation rules, analytics, and response playbooks to improve detection and response capabilities.
• Document investigation findings, incident timelines, root cause analysis, and lessons learned in accordance with established procedures.
• Collaborate with IT, Security, Legal, Risk, HR, and Compliance teams as required during incident investigations.
• Participate in tabletop exercises, incident response simulations, and post-incident reviews to validate and improve response readiness.
• Recommend improvements to security controls, detection content, monitoring coverage, and response processes based on investigative findings.
• Participate in on-call and after-hours incident response support as required.

• Bachelor's degree in Cyber Security, Information Technology, Computer Science, Information Systems, or a related field. Equivalent practical experience may be considered in lieu of a degree.
• 3-5+ years of experience in cyber security incident response, digital forensics, security operations, threat hunting, or related cyber security disciplines.
• Experience investigating and responding to security incidents in enterprise environments.
• Strong understanding of threat actor tactics, techniques, and procedures, cyber attack methodologies, and incident response frameworks.
• Experience working with security monitoring technologies, including SIEM, EDR/XDR, email security, identity security, and cloud security platforms.
• Ability to manage multiple investigations while maintaining attention to detail and documentation quality.
• Strong analytical, problem solving, written, and verbal communication skills.
• Ability to effectively communicate technical findings and risk-based recommendations to both technical and non-technical audiences.
• Proven ability to work independently, manage competing priorities, and perform…