Incident Response Consultant L1

At Armor, we are committed to making a meaningful difference in securing cyberspace. Our vision is to be the trusted protector and de facto standard that cloud‑centric customers entrust with their risk. We strive to continuously evolve to be the best partner of choice, breaking norms and tirelessly innovating to stay ahead of evolving cyber threats and reshaping how we deliver customer outcomes.

We are passionate about making a positive impact in the world, and we’re looking for a highly skilled and experienced talent to join our dynamic team.

Armor has unique offerings to the market so customers can a) understand their risk b) leverage Armor to co‑manage their risk or c) completely outsource their risk to Armor.

Learn more at:

• Plano, Texas:
  Hybrid schedule with mandatory in‑office days on Tuesday, Wednesday, and Thursday.

Armor is seeking an Incident Response Consultant to provide security consultation and incident response services to our managed security customers. This is an in‑office position based at one of our SOC locations. This position consults with customers on security events, analyzes threats using professional judgment, and provides recommendations on detection, response, and remediation strategies. Working directly with customers across diverse environments, this role delivers expert guidance through the incident response lifecycle.

• Consult with customers on security events, providing analysis and recommendations for response actions tailored to their environment.
• Analyze security data across SIEM, EDR, and cloud platforms to identify threats and advise on appropriate countermeasures.
• Provide guidance to customers through the incident response lifecycle based on NIST 800‑53 and SANS best practices.
• Investigate potential compromises and recommend remediation strategies appropriate to customer risk tolerance and business requirements.
• Advise customers on security best practices, control improvements, and risk mitigation approaches.
• Analyze emerging threats and vulnerabilities; provide recommendations on defensive measures.
• Document findings, recommendations, and consultation outcomes for customer delivery.
• Collaborate with senior consultants on complex engagements and escalate as appropriate.

• Linux and Windows Server administration fundamentals.
• Familiarity with cloud platforms (Azure, AWS, GCP) and their security services.
• Working knowledge of security tools: EDR, SIEM (Sentinel, Splunk, etc.), SOAR, and threat intelligence platforms.
• Understanding of networking fundamentals, TCP/IP, and common attack techniques.
• Ability to read and modify code (Python, Power Shell, KQL) for analysis and automation.
• Working knowledge of git version control including branching, commits, and pull request workflows.
• Proficiency with AI‑assisted tools (Claude Code, Git Hub Copilot, or equivalent) for accelerating security analysis and task automation.
• Understanding of AI/LLM security risks including prompt injection, data leakage, and model limitations.
• Ability to critically evaluate AI‑generated outputs for accuracy and security implications.
• Willingness to adopt agentic AI workflows and AI‑augmented tooling as part of daily security operations.
• Analytical mindset with ability to identify indicators of compromise and correlate events across data sources.
• Strong communication skills with ability to convey technical concepts to diverse audiences.
• Customer‑focused with professional consulting demeanor.

• 1‑3 years of experience in security operations, incident response, or security consulting. Prior SOC analyst or IR experience preferred.
• Required certifications within 12 months:
  Microsoft Azure Security Technologies (AZ‑500), Microsoft Security Operations Analyst (SC‑200), Microsoft Identity and Access Administrator (SC‑300).
• Certifications preferred:
  Security+, CySA+, CEH.
• Associate’s or Bachelor’s Degree in Information Technology, Cybersecurity, or related field preferred.

Join Armor if you want to be part of a company that is redefining cybersecurity. Here,…