Cyber Security Incident Commander — Lead IR & Forensics

Optimum; Norwalk (CT); On-site; USD 130,000 - 180,000; Full time

Job summary

Optimum is seeking an experienced Cyber Security Incident Commander to safeguard digital assets and lead incident response efforts. You will own the full lifecycle of incidents, coordinate cross-functional teams, and drive containment, remediation, and communication with executives.

The role emphasizes forensics, threat intel integration, and proactive readiness. Strong collaboration with IT, legal, and regulatory stakeholders is required.

Qualifications

• Bachelor’s degree in Computer Science or related field.
• Advanced CISSP or GIAC certifications preferred.
• Five+ years in IT; three+ years in security/IR.
• Experience with event/log analysis across security tools and networks.

Responsibilities

• Incident command & response across mid-tier and major incidents.
• Lead cross-functional teams: IT, Legal, Communications, Eng, execs.
• Monitor alerts/logs; triage by severity and impact.
• Execute incident response playbooks to contain and remediate breaches.
• Provide business-impact briefings to exec leadership and CISO.
• Forensics & analysis: host/network/memory/cloud forensics.
• Integrate threat intel and hunt for TTPs per MITRE ATT&CK.
• Leverage AI tools to accelerate triage and investigation.
• Own post-incident reviews and root cause analyses.
• Develop and mature IR playbooks, tabletop drills, and exercises.
• Coordinate with law enforcement, regulators, vendors.
• Develop security policies, risk assessments and audits.
• Lead and mentor junior analysts; stay current on threats.

Skills

Incident response

Cyber security ops

Forensics analysis

MITRE ATT&CK

Scripting/automation

Education

Bachelor’s degree in Computer Science or related field

Tools

SIEM

EDR

Firewalls

IDS/IPS

Web proxies

DLP tools

Anti-virus

Job description

Optimum is seeking an experienced Cyber Security Incident Commander to safeguard digital assets and lead incident response efforts. You will own the full lifecycle of incidents, coordinate cross-functional teams, and drive containment, remediation, and communication with executives.

The role emphasizes forensics, threat intel integration, and proactive readiness. Strong collaboration with IT, legal, and regulatory stakeholders is required.