Cyber Incident Response Lead (Hybrid, On-Call)

EY; Jericho (NY); Hybrid; USD 109,000 - 193,600; Full time

Benefits offered by this job

Total Rewards package (medical/dental,

Hybrid work model

Flexible vacation policy

Job summary

EY Technology in New York is seeking a Junior Incident Coordinator to manage cybersecurity incident response and coordination across teams. The role requires strong incident handling skills, diplomacy, and clear written and verbal communication to ensure rapid containment and recovery.

The ideal candidate has 5+ years in SOC/IR-like roles, familiarity with SIEMs (e.g., Splunk), and a solid understanding of Windows and Unix/Linux environments.

Qualifications

• Bachelors or Masters in Computer Science, Information Systems, Engineering, or related field.
• 5+ years’ experience in two or more security roles such as SOC, incident response, or forensic support.
• Deep understanding of security threats, incident response, and forensics.

Responsibilities

• Coordinate response efforts to cyber incidents, including after-hours events.
• Act as liaison across businesses and security teams; manage relationships with partners and vendors.
• Drive integration with other incident programs to ensure consistency across IT.
• Lead small to medium projects as directed by leadership.
• Develop and document scalable incident response processes and playbooks.
• Create metrics and deliver timely leadership reports during and after events.
• Prepare draft communications for leadership and own knowledgebase content.
• Be on-call during rotations as required.

Skills

Incident response

SOC experience

Threat analysis

Communication

Team collaboration

Education

Bachelor's or Master's in CS/IS/Engineering

Tools

Splunk

Job description

EY Technology in New York is seeking a Junior Incident Coordinator to manage cybersecurity incident response and coordination across teams. The role requires strong incident handling skills, diplomacy, and clear written and verbal communication to ensure rapid containment and recovery.

The ideal candidate has 5+ years in SOC/IR-like roles, familiarity with SIEMs (e.g., Splunk), and a solid understanding of Windows and Unix/Linux environments.