Cyber Triage & Forensics Shift Lead

EY; Atlanta (GA); Hybrid; USD 91,000 - 170,000; Full time

Benefits offered by this job

Hybrid work model

Total Rewards package

Paid time off options

Medical and dental coverage

Pension and 401(k) plans

Job summary

EY is seeking a CTF Shift Lead to supervise the Cyber Triage and Forensics team. You will guide Junior and Senior Analysts, ensure rapid threat response, and manage case queues while upholding high security standards across global operations.

You’ll lead incident analysis, update SOPs, mentor teammates, and coordinate with the Technical Lead to support investigations in a flexible hybrid EY environment.

Qualifications

• Bachelor's degree in Computer Science, Information Systems, Information Security, or equivalent (3-4 years).
• 4-5 years in Security Monitoring/SOC environment, investigating events/threats.
• Knowledge of log correlation and intrusion detection platforms.
• Linux and/or Windows admin experience, including AD.
• Scripting or programming skills (Shell, Python, PowerShell, Perl, Java).

Responsibilities

• Manage day-to-day operations and performance of the CTF Analysts.
• Ensure prompt response to email and case queues.
• Distribute workload among threat hunting team and oversee activities.
• Participate in analysis and triage of security events.
• Provide technical leadership and mentorship to junior analysts.
• Set performance expectations and manage team performance.
• Report case status and updates to the global lead.
• Update SOPs and drive continuous improvement.
• Coordinate with Technical Lead for incident/support as needed.

Skills

Security Monitoring

Threat Detection

Incident Response

Linux/Windows Administration

Scripting (Python/PowerShell)

Team Leadership

Communication

Education

Bachelor's in CS/InfoSec

Tools

Active Directory

SIEM platforms

IDS/IPS rules

Job description

EY is seeking a CTF Shift Lead to supervise the Cyber Triage and Forensics team. You will guide Junior and Senior Analysts, ensure rapid threat response, and manage case queues while upholding high security standards across global operations.

You’ll lead incident analysis, update SOPs, mentor teammates, and coordinate with the Technical Lead to support investigations in a flexible hybrid EY environment.