Cyber Security Incidence Response Lead

Staples Advantage Canada; Framingham (MA); On-site; USD 140,000 - 180,000; Full time

Benefits offered by this job

Inclusive culture with ERGs

22 days PTO + holidays

Company discounts & 401(k) match

Job summary

Staples Digital Solutions is seeking a Senior Cyber Security Incident Response Lead in Framingham, MA to protect associates, customers, data, and systems. You will lead hands-on investigations across endpoints, identity, cloud, and network, while guiding response actions and maturing incident response practices.

You will collaborate with Security Operations, Infrastructure, Cloud, Identity, Legal, Privacy, Risk, HR, and other teams, providing senior technical guidance and coordinating across the

Qualifications

• Bachelor’s degree or equivalent experience in CS/InfoSec.
• 7+ years of cybersecurity incident response and related work.
• Experience with complex investigations in large enterprises.

Responsibilities

• Lead investigations from escalation to containment and recovery.
• Analyze telemetry across endpoints, identity, cloud, and network.
• Provide senior technical guidance during significant incidents.
• Coordinate activities across multiple teams and partners.
• Develop and improve incident response playbooks and metrics.
• Conduct proactive threat hunting and post‑incident reviews.
• Support insider risk investigations and risk documentation.
• Collaborate with detection and threat intel teams to improve coverage.
• Participate in on‑call escalation rotation.

Skills

Advanced technical investigation

Analytical thinking

Problem solving

Communication skills

Collaboration

On-call escalation

Education

Bachelor’s degree in CS/InfoSec or related field

Tools

Microsoft Defender XDR

Microsoft Defender for Endpoint

Microsoft Sentinel

Microsoft Entra ID

SOAR platforms

SIEM / EDR

Job description

Staples Digital Solutions is strengthening its cyber defense capabilities, and we’re looking for a senior technical incident response professional to help protect our associates, customers, data, and enterprise technology environment. This role sits within Cyber Security and partners closely with Security Operations, Infrastructure, Cloud, Identity, Legal, Privacy, Risk, Human Resources, and other teams to respond to complex and high-impact cybersecurity events. Based in Framingham, MA, this opportunity reports to the Director of Security Operations and operates as a senior individual contributor with meaningful influence across the enterprise.

As a Cyber Security Incidence Response Lead, you’ll serve as a senior technical escalation resource for significant cybersecurity incidents across Staples. You’ll lead hands‑on investigation and response activities across endpoint, identity, cloud, network, email, and security telemetry to determine threat scope, business impact, root cause, and recommended response actions. You’ll also help mature the incident response program by improving playbooks, exercises, metrics, processes, threat‑hunting practices, detection recommendations, and automation opportunities.

Role requires the incumbent to work at our Framingham, MA facility but we are open to candidates that are willing to relocate to the area. We will also consider providing relocation assistance.

What you’ll be doing:

• Conduct complex cybersecurity investigations from initial escalation through containment, eradication, recovery, and post‑incident review.
• Analyze endpoint, identity, cloud, network, email, and log‑based telemetry to identify attacker activity, determine incident scope, and assess potential impact.
• Provide senior technical guidance during significant incidents in partnership with SOC Leads and Managers.
• Coordinate response activities across Cyber Security, Infrastructure, Cloud, Identity, Legal, Privacy, GRC, Human Resources, external partners, and other business and technology teams.
• Develop and continuously improve incident response plans, investigative procedures, escalation processes, playbooks, exercises, metrics, and supporting documentation.
• Conduct proactive threat hunting based on threat intelligence, vulnerabilities, anomalous activity, and observed adversary techniques.
• Support insider risk investigations involving suspicious user behavior, misuse of access, data loss, or potentially malicious internal activity.
• Document investigation findings, lessons learned, recurring risks, and improvement opportunities from post‑incident reviews.
• Partner with Detection Engineering, Threat Intelligence, and security technology teams to improve detection coverage, investigative capabilities, and automation.
• Participate in an on‑call escalation rotation for significant cybersecurity incidents requiring senior technical expertise.

What you bring to the table:

• Advanced technical investigation, analytical, and problem‑solving skills.
• Sound technical judgment and the ability to make recommendations using incomplete or evolving information.
• Ability to support complex cybersecurity incidents calmly and effectively under pressure.
• Strong written and verbal communication skills, including the ability to translate technical findings into clear business risk considerations and recommended actions.
• Strong collaboration skills across technical and non‑technical teams.
• Curiosity and initiative to identify improvements within the incident response discipline.
• Strong understanding of evolving attacker behaviors, techniques, and technologies.
• Discretion and sound judgment when handling sensitive investigations, including potential insider risk matters.
• Ability to participate in an on‑call escalation rotation for significant cybersecurity incidents.

What’s needed- Basic Qualifications:

• Bachelor’s degree in Computer Science, Information Security, a related field or equivalent work experience.
• 7+ years of cybersecurity experience, including incident response, digital forensics, threat hunting, detection engineering, or Security Operations.
• Experience conducting complex cybersecurity investigations in large enterprise environments.
• Experience developing or maintaining incident response plans, procedures, playbooks, exercises, metrics, or supporting processes.
• Experience conducting post‑incident reviews, root cause analysis, or lessons‑learned documentation.
• Experience coordinating technical response activities across multiple technology and business teams.

What’s needed- Desired Qualifications:

• Experience within larger distributed enterprise environments, ideally retail and/or e‑commerce.
• Advanced technical training or relevant cybersecurity certifications such as GCIH, GCFA, GCFE, GNFA, CISSP.
• Experience with Microsoft Defender XDR, Microsoft Sentinel, Microsoft Defender for Endpoint, or Microsoft Entra ID.
• Experience with SOAR platforms and automated incident response workflows.
• Hands‑on experience investigating endpoint, identity, cloud, network, email, or log‑based security telemetry.
• Hands‑on experience using SIEM, EDR/XDR, identity security, cloud security monitoring, or security automation technologies.
• Experience conducting enterprise threat hunting or developing detection content.
• Experience supporting insider risk, user behavior, data loss, or other user‑focused security investigations.
• Experience investigating identity‑based or cloud‑based attacks.
• Experience responding to ransomware, credential compromise, business email compromise, insider threats, data theft, or supply‑chain incidents.
• Knowledge of cybersecurity incident response requirements, including PCI DSS and applicable privacy requirements.

What’s needed- Desired Qualifications:

• Advanced technical training or relevant cybersecurity certifications such as GCIH, GCFA, GCFE, GNFA, CISSP.
• Experience with Microsoft Defender XDR, Microsoft Sentinel, Microsoft Defender for Endpoint, or Microsoft Entra ID.
• Experience with SOAR platforms and automated incident response workflows.
• Experience conducting enterprise threat hunting or developing detection content.
• Experience supporting insider risk, user behavior, data loss, or other user‑focused security investigations.
• Experience investigating identity‑based or cloud‑based attacks.
• Experience responding to ransomware, credential compromise, business email compromise, insider threats, data theft, or supply‑chain incidents.
• Knowledge of cybersecurity incident response requirements, including PCI DSS and applicable privacy requirements.
• Experience within large retail, e‑commerce, or distributed enterprise environments.

We Offer:

• Inclusive culture with associate‑led Business Resource Groups
• 22 days of PTO and Holiday Schedule (7 observed paid holidays + 1 floating holiday)
• Online and Retail Discounts, Company Match 401(k), Physical and Mental Health Wellness programs, and more!

The salary range represents the expected compensation for this role at the time of posting. The specific base pay may be influenced by a variety of factors to include the candidate’s experience, skill set, education, geography, business considerations, and internal equity. In addition to base pay, this role may be eligible for bonuses, or other forms of variable compensation.