Cyber Triage & Forensics Shift Lead

EY; Chicago (IL); Hybrid; USD 91,000 - 170,000; Full time

Job summary

EY's Information Security team is seeking a CTF Shift Lead to oversee daily operations, triage and investigations, and mentor junior analysts. You will manage case queues, set performance expectations, and coordinate with technical leads to ensure rapid, effective responses to security events.

The role emphasizes leadership within a hybrid work model, with a strong focus on threat intelligence, incident response, and continued SOP improvements to protect EY and client information assets.

Qualifications

• Bachelor's degree in CS/Info Security or equivalent work experience.
• 4–5 years in Security Monitoring/SOC environment.
• Linux and Windows administration incl. Active Directory.
• Scripting or programming skills (Python/PowerShell/Shell).

Responsibilities

• Manage day-to-day operations and performance of the CTF Analysts.
• Ensure prompt response to email and case queues.
• Distribute workload among threat hunting team.
• Participate in analysis and triage of security events.
• Provide technical leadership and mentorship to junior analysts.
• Set clear performance expectations and manage team performance.
• Report case status and incidents to global lead.
• Update SOPs and drive continuous improvement.
• Coordinate with Technical Lead for incident support.

Skills

Network security

Threat hunting

Incident response

Linux

Windows

SOPs

Education

Bachelor's degree in Computer Science/Information Security

Tools

SIEM

Security monitoring tools

Job description

EY's Information Security team is seeking a CTF Shift Lead to oversee daily operations, triage and investigations, and mentor junior analysts. You will manage case queues, set performance expectations, and coordinate with technical leads to ensure rapid, effective responses to security events.

The role emphasizes leadership within a hybrid work model, with a strong focus on threat intelligence, incident response, and continued SOP improvements to protect EY and client information assets.