Incident Response Analyst - Americas

Company Profile

The Carlyle Group (NASDAQ: CG) is a global investment firm with $485 billion of assets under management, across 678 investment vehicles as of June 30, 2026. Founded in 1987 in Washington, DC, Carlyle has grown into one of the world's largest and most successful investment firms, with more than 2,500 professionals operating in 28 offices in North America, Europe, the Middle East, Asia and Australia.

Carlyle’s purpose is to connect people, ideas, and capital to fuel growth for companies and performance for investors, which range from public and private pension funds to wealthy individuals and families to sovereign wealth funds, unions and corporations. Carlyle invests across three segments – Global Private Equity, Global Credit and Carlyle Alp Invest – and has deep expertise across industries, markets, and geographies.

At Carlyle, we believe that a wide spectrum of experiences and viewpoints drives performance and success. Our CEO, Harvey Schwartz, has stated that, "To build better businesses and create value for all of our stakeholders, we are focused on assembling leadership teams with the strongest insights from a range of perspectives." Reflecting this view, emphasis is placed on development, retention and inclusion through our internal processes and seven Employee Resource Groups (ERGs).

We cultivate a culture where ideas are openly shared and challenged, connecting diverse expertise and perspectives to drive enduring value.

The Incident Response Analyst plays a critical role in protecting the organization’s information, technology platforms, and sensitive financial data from increasingly sophisticated cyber threats. This is a hands-on technical position within the Security Operations Center (SOC), responsible for investigating, containing, and resolving security incidents across endpoint, identity, network, cloud, SaaS, and enterprise environments. The successful candidate will combine strong cybersecurity fundamentals with modern detection, investigation, automation, and threat analysis capabilities to rapidly identify malicious activity and reduce organizational risk.

The ideal candidate will possess a strong understanding of incident response, security operations, threat detection, threat hunting, and digital investigation methodologies. They will take ownership of security incidents throughout the response lifecycle, including triage, investigation, containment, eradication, recovery, and post-incident analysis. The analyst will correlate and analyze telemetry from multiple security technologies—including SIEM, XDR, EDR, identity, network, cloud, email, and data protection platforms to reconstruct attack activity, determine scope and impact, identify root cause, and recommend appropriate remediation actions.

Familiarity with contemporary attack techniques and frameworks such as MITRE ATT&CK is essential for understanding adversary behavior and improving detection and response capabilities. This role will be an advocate for an automation-first SOC. The Incident Response Analyst will leverage security orchestration, scripting, APIs, automation platforms, and increasingly AI-assisted security capabilities to accelerate investigations and reduce repetitive manual activities. The analyst should be comfortable identifying opportunities to automate enrichment, evidence collection, alert triage, containment actions, case management, and other repeatable incident response processes while maintaining appropriate human oversight for high-impact decisions.

As enterprise environments increasingly span traditional infrastructure and cloud services, the analyst must understand modern attack surfaces across endpoints, identities, networks, cloud infrastructure,…