Lead Cyber Defense & Incident Response

About the role

This role is a hands-on leadership position within Guardian’s cybersecurity organization, focusing on leading complex cyber incident response efforts, mentoring and developing the next generation of incident responders, and driving operational excellence.

Responsibilities

• Lead and mentor a team of incident response and forensics professionals in a hands-on leadership role.
• Serve as the senior escalation point within the team responsible for investigating complex, high-impact cyber incidents.
• Coordinate response actions with leadership across cybersecurity and security teams while collaborating with legal, enterprise technology, engineering, and other internal teams.
• Develop, maintain, and test incident response plans, playbooks, quick-reference guides, and crisis communication procedures.
• Partner with first-line SOC teams to build muscle memory, clarify containment authorities, and standardize response actions.
• Coordinate with business continuity/disaster recovery teams to ensure an integrated response to large-scale cyber events.
• Drive continuous improvement of logging, monitoring, detection coverage, and UBA capabilities, proactively identifying gaps.
• Ensure incidents are tracked, reported, and reviewed, with high-quality after-action reports and meaningful metrics.
• Manage third-party incident response retainers, readiness exercises, and periodic simulations.
• Collaborate across teams through the hosting of cross-functional incident response training events, and debriefs to align on threats, trends, and lessons learned.
• Champion risk mitigation initiatives and improvements to security control effectiveness.
• Collaborate with cybersecurity leadership on strategy, roadmap development, vendor management, and talent planning.
• Contribute to enterprise programs such as DLP and insider risk management.
• Support internal and external audits, regulatory requests, and due diligence activities.
• Drive incident response maturity, automation, and cyber defense capabilities.
• Develop standard operating procedures for our 1st line SOC based on threats/observed incidents.

Requirements

• Broad and deep technical expertise across enterprise environments, including public cloud and SaaS platforms.
• Experience working with NIST CSF, MITRE ATT&CK, and related security frameworks.
• Hands-on experience with SIEM and log analytics platforms including logging, monitoring, insider threat, and UBA concepts.
• Practical experience working with threat hunting, malware analysis, attacker techniques, and common vulnerabilities.
• Proven ability to lead, mentor, and develop high-performing technical teams.
• Strong written and verbal communication skills, with experience engaging technical teams, executives, and cross-functional partners.
• Analytical, curious, and resilient under pressure; able to think structurally and creatively during incidents.

Qualifications

• BS or MS in cyber security, digital forensics, or equivalent experience and/or industry certifications preferred.
• 5-7 years of overall cybersecurity experience, with a focus on digital forensics, incident response, SOC, or threat mitigation.

Skills

• Strong command of incident response methodologies, digital forensics principles, and evidence handling.
• Knowledge and experience in threat hunting, malware analysis, attacker techniques, and common vulnerabilities.
• Ability to translate cyber threat intelligence into actionable detections, mitigations, and response strategies.
• Experience operating in regulated environments, preferably financial services or insurance, with understanding of U.S. privacy regulations.
• Continuous, lifelong learning with a desire to grow into broader cyber leadership.

Benefits

N/A

Pay

$118,980.00 - $195,465.00

Schedule

Three days a week at a Guardian office in New York, NY or Holmdel, NJ. 20% travel to other Guardian Offices as needed.