SOC Incident Commander

Job Summary

As a Cyber Security Incident Commander at Optimum, you will safeguard the organization’s digital assets by promptly identifying, analyzing, and responding to cyber security incidents. You will minimize the impact of breaches, prevent future incidents, and continuously improve incident response processes.

Responsibilities

• Incident command & response: Serve as incident commander for mid‑tier and major incidents, own the full lifecycle, and direct cross‑functional workstreams (IT, Legal, Communications/PR, Engineering, executives). Monitor alerts and logs; triage and prioritize incidents by severity, criticality, and business impact. Execute response playbooks to contain, mitigate, remediate, and restore systems. Act as primary point of contact to executive leadership and the CISO, translating technical events into business‑impact briefings.
• Forensics & analysis: Conduct host, network, memory, and cloud/hybrid forensics to determine root cause, scope, and extent of compromise while preserving evidence and chain of custody. Perform malware triage and static/dynamic analysis, including sandbox detonation. Integrate threat intelligence and proactively hunt for adversary TTPs mapped to MITRE ATT&CK. Leverage AI‑enabled tooling to accelerate triage, enrichment, and investigation.
• Readiness & continuous improvement: Own post‑incident reviews and root‑cause analyses; capture lessons learned and drive remediation to closure. Develop and mature incident‑response playbooks, tabletop exercises, and readiness drills. Organize and execute security exercises such as Purple Team Exercises, penetration tests, and audits. Define and report IR metrics (MTTD, MTTR) and major‑incident tracking to leadership.
• Program & collaboration: Prepare detailed incident reports covering timeline, impact, remediation, and lessons learned. Coordinate with external parties including law enforcement, regulators, and third‑party vendors. Develop security policies, procedures, and best practices; perform risk assessments and audits for compliance with industry standards. Evaluate and recommend security technologies, partnering with IT to design and implement solutions. Lead and mentor junior analysts, fostering continuous learning. Stay current on emerging threats, vulnerabilities, and industry trends.

Qualifications

• Bachelor’s degree in Computer Science or related field.
• Advanced certifications such as CISSP or incident‑response/forensics GIAC certifications (GCIH, GCFA, GCFE, GNFA) are preferred.
• Minimum five years experience in Information Technology.
• Minimum three years of direct IT Security experience in Cyber Security operations and Incident Response.
• Experience performing event and log analysis with tools such as anti‑virus, IDS, firewalls, Active Directory, web proxies, DLP, etc., in large enterprise environments.
• Ability to communicate complex information confidently in verbal, written, and visual formats.
• Solid working knowledge of networking technology, firewalls, proxies, IDS/IPS, encryption, SIEM, and EDR.
• Experience writing scripts, tools, or methodologies to enhance investigative processes.
• Working knowledge of the MITRE ATT&CK framework and the NIST incident response lifecycle (NIST SP 800‑61).
• Hands‑on experience with industry‑standard forensic toolsets and cloud forensics across major cloud platforms.
• Familiarity with AI tools and an AI‑First mindset.

Pay

The starting pay range for this position is $83,538.00 – $137,241.00 per year, based on skills, experience, and other job‑related factors.