Lead Incident Response Analyst

Job Summary

Serves as the dedicated lead responder for Transocean's Cyber Security Incident Response Team (CSIRT), responsible for leading major investigation, coordination, containment, eradication, recovery, and post‑incident analysis of cybersecurity incidents across enterprise and operational technology environments. Acts as the primary point of contact for cybersecurity incident response activities, coordinating with internal stakeholders, managed security providers, technology teams, and third‑party vendors. Provides expert guidance on cyber threats, incident response processes, threat intelligence, and continuous improvement of the organization's security operations and incident management capabilities.

• Lead and coordinate cybersecurity incident investigations, including triage, analysis, validation, containment, eradication, recovery, and closure of security incidents.
• Serve as the primary incident commander working closely with management during major security events, coordinating activities between Security Operations, Infrastructure, Identity & Application teams.
• Develop, maintain, and improve incident response procedures, playbooks, runbooks, escalation processes, and detection methodologies.
• Lead post‑incident reviews, root‑cause analysis activities, lessons learned sessions and recommend corrective actions to prevent recurrence.
• Communicate incident status, risks, and remediation activities to technical teams, management, executives, and external stakeholders.
• Provide mentoring and guidance to junior analysts, MSSP personnel, and incident response stakeholders regarding incident handling procedures and cyber threats.
• Produce incident metrics, reports, KPI dashboards, and executive summaries that measure CSIRT effectiveness and operational maturity.
• Lead continuous improvement initiatives across security monitoring and incident response functions by collaborating with Security Engineering teams to enhance detection coverage, automate response activities, improve security analytics, and drive operational metrics such as mean time to detect (MTTD), mean time to respond (MTTR), and overall incident response effectiveness.

• Minimum
  
  Required:
  
  Bachelor's degree in Information Technology or Cybersecurity related experience, one or more security certifications such as Security+.
• Preferred:
  Bachelor's degree in Information Technology or Cybersecurity related experience, one or more security certifications such as Security+, GCIH, GCFA, CISSP, CISM or equivalent.

• Minimum
  
  Required:
  
  3 years focused on incident response, threat hunting, security operations or cyber investigations.
• Preferred: 7+ years of cybersecurity experience leading Security Operations Center (SOC).