Cyber Triage & Forensics Shift Lead

Ernst & Young Oman; Annapolis (MD); Hybrid; USD 91,000 - 170,000; Full time

Benefits offered by this job

Medical and dental coverage

Pension and 401(k)

Paid time off

Job summary

EY in the United States seeks a CTF Shift Lead to guide the Cyber Triage and Forensics team, mentoring Junior and Senior Analysts and ensuring rapid threat response.

You will set performance expectations, provide technical leadership, and maintain SOPs while reporting to the global leadership team in a hybrid work environment. Strong collaboration with security experts and cross‑team coordination is essential.

Qualifications

• Bachelor's degree in a relevant field or equivalent work experience.
• 4–5 years in Security Monitoring/SOC environment, investigating events/threats.
• Understanding of electronic investigation and log correlation with intrusion detection platforms.

Responsibilities

• Manage day-to-day operations and performance of the CTF Analysts
• Ensure prompt and efficient response to email and case queues
• Distribute workload among the threat hunting team and oversee their activities
• Participate in the analysis and triage of security events
• Provide technical leadership and mentorship to junior analysts
• Set clear performance expectations and manage team performance
• Report case status and significant incident updates to the global lead
• Update Standard Operating Procedures (SOPs) and drive continuous improvement within the team
• Coordinate with the Technical Lead for incident and investigation support as needed

Skills

Security Monitoring

SOC

Leadership

Threat hunting

Incident response

Python scripting

Linux

Windows

Active Directory

Education

Bachelor's degree in Computer Science, Information Systems, Information Security, or equivalent

Tools

Security event platforms

SIEM

Linux/Windows admin tools

Job description

EY in the United States seeks a CTF Shift Lead to guide the Cyber Triage and Forensics team, mentoring Junior and Senior Analysts and ensuring rapid threat response.

You will set performance expectations, provide technical leadership, and maintain SOPs while reporting to the global leadership team in a hybrid work environment. Strong collaboration with security experts and cross‑team coordination is essential.