Principal, Cybersecurity Incident Responder - Remote

Work Flexibility:
Remote The Principal Cybersecurity Incident Responder is a senior technical cybersecurity leader responsible for leading the response to significant and complex cybersecurity incidents. This role establishes technical priorities, drives investigations, and guides incidents through containment, eradication, and recovery. You will apply broad cybersecurity expertise and deep, hands‑on incident response experience to make timely, risk‑based decisions in complex and rapidly evolving situations.

During significant incidents, you will serve as the Technical Response Lead, partnering closely with Investigations, Detection Engineering, Security Engineering, Cyber Threat Intelligence (CTI), Threat Hunting, Forensics, Security Operations, and other cybersecurity specialists. Outside of active incidents, you will strengthen response readiness by improving playbooks, exercises, telemetry, tooling, automation, and lessons‑learned processes, including identifying responsible opportunities to leverage AI. Preference will be given to candidates located in Eastern or Central time zones to support effective collaboration during core business hours.

• Lead the technical response to significant and complex cybersecurity incidents from initial investigation through containment, eradication, and recovery.
• Establish technical priorities, maintain momentum, and make timely, risk‑based decisions when information is incomplete, conflicting, or rapidly changing.
• Partner across Investigations, Detection Engineering, Security Engineering, CTI, Threat Hunting, Forensics, Security Operations, and other teams to determine incident scope and coordinate response actions.
• Apply deep knowledge of attacker tactics, techniques, and procedures to incidents involving identity compromise, ransomware, malware, cloud compromise, lateral movement, data exfiltration, and other advanced threats.
• Evaluate investigative findings, identify critical gaps, test hypotheses, and translate available evidence into effective containment, eradication, and recovery strategies.
• Balance rapid containment with business impact, operational continuity, evidence preservation, and the need to fully understand incident scope.
• Develop and continuously improve incident response playbooks, procedures, and technical capabilities based on real‑world incidents, exercises, emerging threats, and lessons learned.
• Design and facilitate technical tabletop exercises and simulations to validate response capabilities and identify improvement opportunities.
• Identify telemetry, tooling, access, and visibility gaps and partner with technical teams to strengthen detection and response capabilities.
• Leverage AI, automation, and orchestration where appropriate to accelerate investigation and response while maintaining appropriate human oversight.
• Lead technical contributions to post‑incident reviews and drive improvements across telemetry, detections, tooling, automation, procedures, and training.
• Serve as a senior technical resource and mentor, strengthening incident response capabilities and decision‑making across the cybersecurity organization.

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Security, or a related field, or an equivalent combination of education and relevant professional experience.
• 8+ years of relevant cybersecurity experience across incident response, digital forensics, threat hunting, security operations, security engineering, or related disciplines.
• Relevant industry certifications in incident response, digital forensics, security operations, cloud security, or related cybersecurity disciplines preferred.

• CISSP
  -…