Incident Response Analyst Lead (Remote, IRE)

Develop and deliver scenario-based training exercises for CSIRT to strengthen investigative skills and readiness. Take ownership of projects assigned by CSIRT leadership, implementing improvements that enhance workflows, tools, and response effectiveness. Manage escalated incidents by gathering and analyzing evidence from logs, endpoint telemetry, and threat-intel sources; perform and adapt investigative or containment actions from playbooks—such as host isolation, phishing email removal —and confirm remediation. Conduct in-depth research on topics that support team operations and improve investigative capabilities. Maintain clear documentation of investigative steps, evidence, decisions, and project progress to support transparency and knowledge sharing. Identify gaps in detection coverage, workflows, or tooling, and collaborate on new detection logic, playbook refinements, and automation opportunities. Contribute to the creation and maintenance of runbooks, knowledge articles, and other deliverables that strengthen CSIRT’s incident response capabilities.