Security Incident Response Analyst

Lead end-to-end investigations into phishing, malware, insider threats, and other advanced security incidents Triage and analyze security alerts, distinguishing true threats from noise, and prioritize response based on risk and business impact. Perform technical malware analysis, including static and dynamic examination of suspicious files, to determine behavior, capability, and intent.

Conduct host and network-based analysis — analyzing system logs, processes, registry/configuration artifacts, memory, traffic patterns, DNS activity, and connection logs — to reconstruct attacker activity and identify persistence, command-and-control, lateral movement, and data exfiltration. Investigate cloud-native incidents by analyzing audit logs, IAM and access activity, and network flow data to detect unauthorized access, privilege misuse, and malicious file activities across cloud environments.

Drive incidents through containment, eradication, and recovery, coordinating with cross-functional teams as needed. Develop and refine detection logic, playbooks, and response procedures to improve the team's ability to identify and act on emerging threats. Act as an escalation point for the most technically complex cases, mentoring junior analysts.

Document findings and communicate clearly with both technical and non-technical stakeholders, including post-incident reports and executive summaries.