Incident Management Lead

About the role

Leads enterprise cybersecurity incident management and response operations, overseeing incident detection, investigation, analysis, containment, eradication, and recovery. Directs incident coordination, digital forensics, threat intelligence integration, and response activities to minimize operational impact and strengthen enterprise cyber resilience.

Responsibilities

• Lead enterprise incident response operations, including incident triage, classification, investigation, containment, eradication, recovery, and post-incident analysis.
• Develop, maintain, and execute Incident Response Plans, CONOPS, SOPs, escalation procedures, and technical playbooks aligned with NIST SP 800-61 and applicable federal requirements.
• Direct incident investigations using SIEM, SOAR, EDR/XDR, network traffic analysis, endpoint telemetry, and digital forensic tools, including Splunk, Microsoft Defender, Wireshark, Volatility, and approved forensic platforms.
• Coordinate digital forensics and incident analysis involving malware, compromised endpoints, credential theft, lateral movement, unauthorized access, data exfiltration, and advanced persistent threats.
• Apply MITRE ATT&CK tactics, techniques, and procedures (TTPs