Incident Response Lead
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Incident Response Lead directing cybersecurity incidents for Harbor IT’s managed services clients. Building playbooks, escalation processes, and response practice across regulated environments.
Responsibilities:
- Serve as incident commander for client security incidents
- Establish scope, set response priorities, assign actions to named owners, track decisions, and keep incidents moving
- Run triage and initial investigation across Microsoft 365, Entra ID, Active Directory, EDR-managed endpoints, servers, firewalls, and the Sagan detection pipeline
- Delegate information gathering while focusing on incident-command decisions
- Own containment decisions involving isolation, credential resets, evidence preservation, and client approval authority
- Decide whether incidents remain within Harbor’s scope or require escalation to outside DFIR firms, breach counsel, or insurance panels
- Own in-scope incidents from detection through post-incident reporting
- Brief receiving DFIR firms and hand off with a written timeline and evidence inventory
- Carry on-call responsibility and remain available outside business hours for incident escalation
- Translate technical findings into actionable decisions for owners, executives, and general counsel
- Coordinate with breach counsel, cyber insurance carriers and panel firms, third-party DFIR teams, client IT, and law enforcement where applicable
- Keep Client Success and leadership current on active incidents
- Produce post-incident reports covering confirmed and assumed facts, containment, open items, and recommended client changes
- Write and maintain incident response playbooks, severity model, and escalation matrix
- Define Harbor’s incident-response responsibility boundaries in writing
- Build working relationships with outside DFIR firms and breach counsel practices
- Maintain escalation-readiness records for every managed client
- Run tabletop exercises with Harbor teams and clients when applicable and feasible
- Mentor SOC analysts and security engineers on investigative method and incident discipline
- Feed incident lessons back to detection engineering to improve future detection
Requirements:
- 6+ years in cybersecurity, with substantial time spent responding to real intrusions rather than monitoring for them
- Direct experience acting as the lead on security incidents, setting direction while others execute
- Experience responding across multiple distinct organizations, whether from a consulting, MSSP, MDR, or panel DFIR background
- Hands-on investigative depth in Microsoft 365, Google Workspace, and Entra ID compromise
- Experience with unified audit log analysis, message trace, mailbox rules and forwarding, OAuth consent and application grants, device code and token abuse, and conditional access gaps
- Working command of endpoint detection and response tooling for investigation and containment
- Host and Windows internals knowledge sufficient to interpret process lineage, persistence mechanisms, and lateral movement evidence
- Ability to build defensible incident timelines from SIEM and detection alerts, endpoint telemetry, cloud audit logs, firewall logs, and help desk tickets
- Practical understanding of ransomware and hands-on-keyboard intrusion tradecraft
- Experience working alongside breach counsel, cyber insurance carriers, or third-party DFIR firms during a live incident, including investigation handoff
- Ability to brief non-technical executives under pressure and write clear, actionable client documentation
- Willingness and ability to be reachable outside business hours for incident escalation
- Preferred: GCIH, GCFA, GCIA, or comparable GIAC certification; CISSP or CISM
- Preferred: prior experience at a panel DFIR firm, MDR provider, or MSSP incident response team
- Preferred: host and memory forensics, malware triage, or reverse engineering
- Preferred: Linux investigation experience and cloud incident response beyond Microsoft, such as AWS
- Preferred: familiarity with HIPAA, PCI DSS, GLBA, state breach notification statutes, or SEC disclosure rules
- Preferred: background in managed services or another multi-tenant environment where the candidate owned both the relationship and investigation
Benefits:
- Employer-paid medical, dental, and vision coverage for the employee, with additional premium plan options available
- 401(k) with company match
- Paid time off
- Reimbursement for approved tuition, certifications, and conference attendance
Similar Jobs
Recepcionista de Llamadas
Recepcionista remoto atendiendo consultas y reclamos de clientes PostPago de Claro Perú. Gestión de atención al cliente con sueldo fijo y bonos.
Asesor de portabilidad, full time
Asesor de portabilidad remota para Claro, contactando clientes de otros operadores. Ofreciendo beneficios y ofertas para impulsar cambios de operador.
Crosseling, Part Time
Asesor telefónico remoto para MDY, contact center de telecomunicaciones. Resolución de consultas de Claro y cross-selling en jornada part time.
Project Lead Practitioner
Project Lead Practitioner leading technology diligence and value-creation engagements for Crosslake’s private equity and technology-business clients. Assessing technology risks, opportunities and operating models.
HVAC Tech Support
HVAC technical support representative helping U.S. homeowners troubleshoot heating and cooling products by phone. Alpine sells high-efficiency heating and air-conditioning equipment through e-commerce.
Campaign Coordinator
Campaign Coordinator executing integrated B2B marketing campaigns for Osano’s data privacy platform. Coordinating cross-channel launches, CRM automation, QA, reporting, and stakeholder deliverables.
Domestic Violence Housing Coordinator, Homeless Services
Domestic Violence Housing Coordinator coordinating survivor-centered housing referrals and placements. Supporting ICF’s homelessness services work through HUD Coordinated Entry, partner engagement, and housing navigation.
Co-Founder, B2B
B2B startup co-founder validating problems, testing MVPs and building a founding team through Startup Wise Guys’ 12-week online venture programme.
Homeless Services, Coordinated Entry System Coordinator
CES Coordinator implementing HUD Coordinated Entry and housing-referral systems for ICF’s advisory and technology services. Analyzing HMIS data, training providers, and improving housing placements.
Drone Pilot
Drone Pilot capturing RGB and thermal data for Zeitview’s intelligent aerial imaging platform. Supporting quality control, pilot training, operations, and drone equipment maintenance.
Field Experience Specialist
Customer experience specialist supporting Allegion’s security-product customers and resolving order and account issues. Managing customer relationships, service requests, and process improvements remotely across the US.
Drone Pilot
Drone Pilot conducting drone data-capture missions for Zeitview’s intelligent aerial imaging platform. Supporting quality control, pilot training, operations planning, and equipment maintenance.
Health Specialist, RN
Remote RN providing advanced clinical responses on CDC health topics for Maximus. Supporting medical professionals, government agencies, and emergency-related inquiries.
Mathematical Physicist, PhD
Mathematical physicist creating, solving, and reviewing research-level physics benchmarks. Supporting Mercor’s work training frontier AI models with verifiable expert reasoning.
Trabaja desde casa - Part Time 5pm a 10pm
Asesor telefónico remoto para MDY, empresa BPO de telecomunicaciones. Resolución de consultas sobre recargas, saldo y cobertura en campaña prepago de Claro.
ATC - Part Time
Asesor telefónico remoto atendiendo consultas sobre servicios móviles Claro. MDY, empresa transnacional de BPO, ofrece turnos part time y capacitación pagada.
Agente de Portabilidad
Asesor de portabilidad para Claro en Partner Service, empresa líder en telecomunicaciones. Gestionando ventas remotas con turnos Full Time o Semi Full.
Creative Project Specialist
Creative Project Specialist coordinating video projects and QA for a performance marketing agency serving financial advisors. Managing deadlines, revisions, deliverables, and editor feedback.
Creative Services Coordinator
Creative Services Coordinator coordinating video projects and QA for a Meta advertising agency serving financial advisors. Managing deadlines, revisions, deliverables, and creative workflows.
Consent & Device Recovery Coordinator
Part-time remote coordinator recovering patient consents and medical devices for InfuSystem, a nationwide infusion pump services provider. Documenting calls and supporting billing, patients, customer service, and revenue cycle teams.