Associate Director, Incident Response and Forensics

CSL Behring; False Pass (AK); On-site; USD 140,000 - 190,000; Full time

Job summary

CSL Behring is seeking a senior cybersecurity incident response leader to guide a global team through the full incident lifecycle. The role emphasizes preparation, identification, containment, eradication, and recovery, with a focus on strengthening detection and response maturity across enterprise systems.

The position requires proven expertise in threat hunting, forensics, and network analysis, as well as collaboration with Compliance, Legal, and Privacy teams to address eDiscovery matters.

Qualifications

• Experience leading global security incident response teams.
• Proven record in network memory analysis, endpoint analysis, and cyber incident lifecycle.
• Familiarity with NIST 800-61 and incident handling best practices.

Responsibilities

• Lead a global cybersecurity incident handling team to support the incident response lifecycle (Prepare, Identify, Contain, Eradicate, Recover).
• Develop and maintain a continuous upskilling program for the team.
• Identify and implement tools to determine attack types and defenses for each incident.

Skills

Cybersecurity leadership

Incident response

Threat hunting

Forensics analysis

Network analysis

Job description

• Leads a global team to apply security incident handling processes for CSL to successfully support the cybersecurity and information security incident response process to: Prepare, Identify, Contain, Eradicate, Recover from cybersecurity events.
• Develop and maintain a continuous upskilling program for your team to increase skills and overall capability maturity.
• Identify and implement tools to determine attack types and choose appropriate defenses and response tactics for each.
• Derive Indicators of Compromise (IOCs) from malicious activity to strengthen incident response, threat detection, and intelligence efforts.
• Conduct in-depth forensic analysis of various operating systems.
• Examine traffic using common network protocols to identify patterns of activity or specific actions that warrant further investigation.
• Detect and hunt for adversary tools, tactics, and procedures (TTPs) across an enterprise environment.
• Partner with Compliance, Legal, Privacy, and other teams to perform internal investigations pertaining to eDiscovery matters.
• Demonstrates thought leader-level abilities with, and/or a proven record of success directing efforts in the following areas: Network Analysis, Computer Memory Analysis, Endpoint Analysis, Cyber Incident Lifecycle, NIST 800-61. Lead and supervise teams to create an atmosphere of trust and seek diverse views to encourage improvement and innovation, answer questions and provide direction to less-experienced staff, coach staff including providing timely meaningful written and verbal feedback.