Cyber Triage & Forensics Shift Lead

Ernst & Young Oman; Chicago (IL); Hybrid; USD 91,000 - 170,000; Full time

Benefits offered by this job

Hybrid work model

Competitive compensation

Medical and dental coverage

Job summary

EY seeks a CTF Shift Lead in a hybrid US role to oversee the Cyber Triage and Forensics team. You will manage junior and senior analysts, drive incident response, and ensure swift threat handling with clear performance expectations.

You will report to global leadership, contribute to SOP updates, and guide investigations while aligning with cybersecurity best practices across the organization.

Qualifications

• Bachelor's degree in Computer Science, Information Systems, Information Security, or equivalent.
• 4–5 years in Security Monitoring/SOC environment, investigating events/threats.
• Experience with electronic investigation, log correlation, and IDS/IPS concepts.
• Working knowledge of Linux and/or Windows systems administration, including Active Directory.
• Scripting or programming skills (Shell, Python, PowerShell, Perl, Java).

Responsibilities

• Manage day-to-day operations and performance of the CTF Analysts.
• Ensure prompt and efficient response to email and case queues.
• Distribute workload among threat hunting team and oversee activities.
• Participate in analysis and triage of security events.
• Provide technical leadership and mentorship to junior analysts.
• Set clear performance expectations and manage team performance.
• Report case status and significant incident updates to the global lead.
• Update SOPs and drive continuous improvement within the team.
• Coordinate with the Technical Lead for incident and investigation support.

Skills

Security Monitoring

SOC

Incident Response

Linux

Windows

Python

PowerShell

Shell scripting

Education

Bachelor's degree in Computer Science / Information Security

Tools

Intrusion Detection Platforms

Active Directory

SIEM

Job description

EY seeks a CTF Shift Lead in a hybrid US role to oversee the Cyber Triage and Forensics team. You will manage junior and senior analysts, drive incident response, and ensure swift threat handling with clear performance expectations.

You will report to global leadership, contribute to SOP updates, and guide investigations while aligning with cybersecurity best practices across the organization.