Cyber Incident Response Lead; Remote

Company Description

Experian is a global data and technology company, powering opportunities for people and businesses around the world. We help to redefine lending practices, uncover and prevent fraud, simplify healthcare, create digital marketing solutions, and gain deeper insights into the automotive market, all using our unique combination of data, analytics and software. We also assist millions of people to realise their financial goals and help them to save time and money.

We operate across a range of markets, from financial services to healthcare, automotive, agrifinance, insurance, and many more industry segments.

We invest in people and new advanced technologies to unlock the power of data and to innovate. A FTSE 100 Index company listed on the London Stock Exchange (EXPN), we have a team of 23,300 people across 32 countries. Our corporate headquarters are in Dublin, Ireland. Learn more at

As a member of Experian's Global Security Office (EGSO)/Cyber Fusion Center (CFC), you will respond, contain, and investigate, and coordinate mitigation of security events relative to anomalies detected and escalated by the Cyber Fusion Center according to Experian's Incident Response Plan. As an individual contributor, you will join a growing team of specialized, advanced responders to support escalations of complex and prioritized matters from Experian's existing 24x7 security monitoring and response functions.

You will work with end‑users, technical support teams, and management to ensure remediation and recovery from these threats.

You will report to the Senior Manager, Global Incident Response. You will have a regular Monday – Friday schedule, with the expectation to participate in an on‑call schedule or work outside of normal work hours to respond to cybersecurity incidents.

• Conduct advanced incident response activities to investigate and contain complex or larger‑scale cybersecurity matters.
• Orchestrate work streams across teams (Forensics and Cyber Threat Hunting) and explain the CFC's overall understanding of the timeline of attacker activity.
• Respond to cybersecurity events and alerts associated with threats, intrusions, or compromises per any applicable SLOs.
• Manage multiple cases related to security incidents throughout the incident response lifecycle, including Analysis, Containment, Eradication, Recovery, and Lessons Learned.
• Coordinate successful conclusion of security incidents according to Process & Procedures, and elevate severe incidents according to Experian's Incident Response Plan.
• Maintain case documentation, including notes, analysis findings, containment steps, and cause for each assigned security incident.
• Maintain assigned caseload and move incidents through each phase of the IR Lifecycle, handing off cases as needed for progress.
• Maintain an understanding of common Operating Systems (Windows, Linux, Mac OS), Security Technologies (Anti‑Virus, Intrusion Prevention), Cloud Security investigations and response tools, and Networking (Firewalls, Proxies).
• Interpret device and application logs from a variety of sources (Firewalls, Proxies, Web Servers, System Logs, Splunk, Packet Captures) to identify the root cause and determine the next steps for containment, eradication, and recovery.
• Support overall direction for the CFC and input to the security strategy.
• Mentor and provide advanced support to analysts (Logs review, IP Block question).

• 8+ years of experience working within cybersecurity or information technology roles, at least 4+ of which includes working as an investigator, analyst, or leader in a Cyber Incident Response Team.
• Bachelor's Degree in Computer Science, Computer Engineering, Information Systems, Information Security, or a related field. 11+ years of experience working within a Security Operations Center, Incident Response Team, law enforcement, or military experience may be accepted in lieu of this requirement.
• Knowledge of network protocols (TCP/IP, UDP, ICMP), standard protocols (HTTP/S, DNS, SSH, SMTP, SMB), wireless networking, networking infrastructure, and network topologies (DMZ, VPN, WAN) and network…