Information Technology Manager II

Location: Northern

## Information Technology Manager IIApplylocations:
US-CO-Colorado (Remote Employees) time type:
Full time posted on:
Posted Todayjob requisition :
R246926#
** Position:
** Information Technology Manager II#
*
* Job Description:

**** What You'll Be Doing:
**** Incident Response & Investigations
*** Lead complex cyber incident investigations across enterprise, cloud, hybrid, and on-premises environments.
* Conduct end-to-end incident response activities including triage, scoping, containment, eradication, recovery, and post-incident reporting.
* Investigate network intrusions, account compromise, ransomware, insider risk, fraud-related incidents, unauthorized access, and advanced threat actor activity.
* Preserve evidence and maintain chain-of-custody procedures for forensic, legal, compliance, and regulatory investigations.
* Produce clear investigative findings, root cause analysis, executive summaries, and remediation recommendations.
** Digital Forensics & Malware Analysis
*** Perform DFIR activities across Windows, cloud, identity, endpoint, network, and application environments.
* Conduct dead-box forensic examinations, artifact analysis, timeline analysis, and evidence collection.
* Collect, analyze, and interpret host, network, cloud, email, identity, and application artifacts.
* Analyze suspicious files, malware behavior, persistence mechanisms, attacker tooling, and indicators of compromise.
* Support sensitive investigations involving Legal, HR, Compliance, Insider Risk, and business stakeholders.
** Threat Hunting & Detection Engineering
*** Conduct proactive threat hunting to identify adversary behaviors, emerging threats, and control gaps.
* Develop, tune, and improve SIEM detections, correlation rules, KQL queries, alerts, dashboards, and response workflows.
* Apply MITRE ATT&CK, threat intelligence, incident lessons learned, and attacker TTPs to improve detection coverage.
* Partner with SOC, Threat Intelligence, Engineering, and Platform teams to validate visibility and improve response outcomes.
* Support continuous improvement of threat detection, alert quality, incident workflows, and security monitoring use cases.
** Security Engineering & Platform Support
*** Support the engineering, administration, and optimization of cyber security tools and platforms.
* Assist with log source onboarding, data normalization, telemetry validation, and use-case development.
* Partner with Infrastructure, Cloud, Identity, Application, and Security Operations teams to improve visibility and response capability.
* Build scripts, queries, automation, dashboards, and technical workflows that improve investigation speed and quality.
* Help mature enterprise security capabilities across SIEM, EDR, NDR, SOAR, cloud security, identity security, and forensic tooling.
** AI, Security Automation & Emerging Technologies
*** Use AI-assisted tools, copilots, automation, and scripting to improve investigation efficiency, reporting, and analysis.
* Demonstrate curiosity and willingness to learn emerging AI, automation, and agent-assisted security operations capabilities.
* Contribute to team initiatives involving AI-assisted workflows, personal security agents, team-developed agents, and operational automation.
* Show evidence of hands-on experimentation through lab work, scripting, automation, prompt testing, AI tools, or practical tinkering.
* Understand the security considerations of AI usage, including data protection, responsible use, prompt safety, and operational governance.
** Threat Emulation, Red Teaming & Purple Team Support, Preferred
*** Apply an offensive security mindset during investigations to better understand attacker behavior, objectives, and tradecraft.
* Support threat emulation and purple team activities that validate detections, controls, and response procedures.
* Use knowledge of penetration testing, red teaming, adversary simulation, or ethical hacking to strengthen blue team defenses.
* Assist with threat actor tracking, attack path analysis, lateral movement analysis, persistence review, and detection validation.
* Preferred experience with MITRE ATT&CK, Atomic Red Team, adversary emulation, detection testing, BAS tools, or offensive security labs.
** Leadership & Mentorship
*** Serve as a senior technical lead during significant cyber security investigations and incident response efforts.
* Mentor SOC Leads, Security Analysts, Incident Responders, and Security Engineers on investigative and forensic methodologies.
* Contribute to playbooks, runbooks, investigation standards, threat hunting procedures, and operational documentation.
* Help mature the organization’s DFIR, Incident Response, Detection Engineering, Threat Hunting, and Security Automation capabilities.
* Communicate effectively with technical teams, leadership, Legal, HR, Compliance, and business stakeholders.
** What We Are Looking For:
*** 5–10+ years of experience in Cyber Security, Incident Response, DFIR, Threat Hunting, Detection Engineering, Security Operations, or…