Senior Cybersecurity Incident Handler

Description

Security Operations needs an incident handler to investigate, coordinate, and resolve cyber security incidents across the enterprise.

You will triage alerts by risk and business impact, form and test hypotheses, collect evidence, analyze hosts, support containment, eradication, and recovery, document the work, and escalate as needed.

Beyond case work, you will cut repeat effort by turning manual or error-prone steps into documented workflows, automations, integrations, and reusable investigation tools. This includes Python utilities, parsers, dashboards, and command-line tools, GitHub Actions and CI/CD pipelines, and security capabilities managed through Terraform, GitOps, source control, and peer-reviewed deployments. You will also connect threat-intelligence and collaboration tools such as MISP, Slack, GitHub, Confluence, and Sguil.

Responsibilities

• Investigate alerts involving endpoints, identities, malware, suspicious processes, persistence, network activity, and possible data exposure.
• Build investigation plans, preserve relevant evidence, review endpoint telemetry and live-response output, and record what you find.
• Carry out or coordinate approved containment, eradication, and remediation, such as host isolation, live response, file retrieval or removal, directory cleanup, and scheduled-task removal.
• Work in CrowdStrike Falcon, Next-Gen SIEM, live-response tools, IT Automation, and other security platforms during response.
• Liaise with Response, Detect, Endpoint, Engineering, Insider Threat, Threat Intelligence, and other teams.
• Judge severity, business impact, scope, and risk, escalate when needed, and give clear updates to technical and leadership audiences.
• Spot indicators of compromise and investigative leads, then work with detection and intelligence teams to tune correlation rules, hunting, and monitoring.
• Write complete, accurate, lasting incident records covering timelines, actions taken, evidence, containment choices, root causes, and lessons learned.
• Maintain response playbooks, wiki pages, workflow documentation, and operating procedures.
• Find recurring friction and build secure scripts, automations, dashboards, integrations, and workflows that make responders faster.
• Test new response capabilities, check safeguards and permissions, and help move them through development, test, and production.
• Join incident reviews, process improvement, mentoring, and knowledge sharing across Security Operations.

Requirements

• Handle incident triage, scoping, evidence collection, endpoint investigation, containment, remediation, and operational recovery.
• Design Windows live-response work across multiple hosts, including timeout handling, YARA scanning, file retrieval, and file removal.
• Administer and engineer CrowdStrike Falcon, including Fusion Workflows, IT Automation, Next-Gen SIEM, custom IOA rules, lookup files, detections, APIs, and endpoint response.
• Design workflows for directory and scheduled-task removal, live-response deployment, file operations, host-online notifications, detection auto-closure, host containment, and BitLocker recovery.
• Build CrowdStrike integrations with Slack, MISP, Sguil, GitHub, and other operational tools.
• Write correlation rules, including real-time Next-Gen SIEM rules and rules for suspected DPRK activity.
• Write Python for security data exports, command-line tools, API integrations, data transformation, and operational services.
• Design GitHub repositories, deliver changes through pull requests, and use GitHub Actions, GitHub Pages, workflow automation, and cross-repository sync.
• Run multi-environment CI/CD deployments for CrowdStrike and Velociraptor capabilities.
• Design the MISP-to-CrowdStrike IOC integration used by intelligence and detection teams.
• Have recovered and migrated more than 80 Next-Gen SIEM correlation rules after an author-permission dependency created operational risk.
• Have consolidated Response, Security Operations, Detect, Engineering, and NSM SID documentation into a unified GitHub Pages wiki.
• Have built automated sync of incident writeups from the GitHub wiki to Confluence.
• Write clear technical documentation on deployment, single-host and multi-host use, timeout settings, troubleshooting, and procedures.
• Preferred: experience with Velociraptor or comparable endpoint live-response platforms.
• Preferred: experience with YARA, endpoint telemetry, host artifacts, and forensic collection workflows.
• Preferred: experience integrating MISP, CrowdStrike, Slack, Confluence, GitHub, Sguil, Databricks, or comparable enterprise security platforms.
• Preferred: experience in regulated or highly governed enterprise environments.
• Preferred: experience contributing to open-source security or infrastructure tooling.
• Preferred: experience migrating documentation or operational content between wiki platforms.
• Preferred: experience designing secure automation with role-based access, audit trails, approval controls, and rollback planning.

Conditions

Hybrid role: you report to a specific location at least 3 times a week, or at another frequency set by your manager.

The company does not provide immigration sponsorship for this role. Do not apply if you will need immigration sponsorship now or in the future. This covers direct company sponsorship, naming the company as employer of record on a government form, and any work authorization that needs a written submission or other immigration support from the company, such as H1-B, OPT, STEM OPT, CPT, TN, or J-1.

Relocation benefits are available to candidates who qualify under company policy.

Posting code: LI-SB3.

Candidates may be required, where applicable, to complete a role-related assessment and/or pre-employment screening before starting.

The company is committed to a workplace free of unlawful discrimination that also fosters inclusion and belonging.

Benefits

• Support for well-being at work and at home from day one.
• Total rewards information is available from the company.