Cyber Triage & Forensics Shift Lead

EY; Washington (District of Columbia); Hybrid; USD 91,000 - 170,000; Full time

Benefits offered by this job

Medical and dental coverage

Pension and 401(k) plans

Vacation and paid time off

Hybrid work model

Job summary

EY is seeking a CTF Shift Lead within its Information Security team in the United States. You will supervise a team of CTF Analysts, drive performance, and ensure rapid threat triage in a hybrid work environment.

Reporting to the global leadership, you will set expectations, mentor junior analysts, and coordinate incident response with the Technical Lead, SOP updates, and continuous improvement across the security operations center.

Qualifications

• Bachelor's degree or equivalent in CS/InfoSec.
• 4–5 years in a SOC or security monitoring environment.
• Knowledge of log correlation and intrusion detection.
• Linux/Windows administration knowledge.
• Scripting or programming skills (Python/PowerShell).

Responsibilities

• Manage day-to-day operations and performance of the CTF Analysts.
• Ensure prompt response to email and case queues.
• Distribute workload among threat hunting team and supervise activities.
• Participate in analysis and triage of security events.
• Provide technical leadership and mentorship to junior analysts.
• Set clear performance expectations and manage team performance.
• Report case status and significant incident updates to global lead.
• Update SOPs and drive continuous improvement within the team.
• Coordinate with the Technical Lead for incident and investigation support.

Skills

Network security

Endpoint security

Threat intelligence

Python

PowerShell

Linux

Written communication

Education

Bachelor's degree in Computer Science / Information Security

Tools

Active Directory

Security event platforms

IDS/IPS rules

Job description

EY is seeking a CTF Shift Lead within its Information Security team in the United States. You will supervise a team of CTF Analysts, drive performance, and ensure rapid threat triage in a hybrid work environment.

Reporting to the global leadership, you will set expectations, mentor junior analysts, and coordinate incident response with the Technical Lead, SOP updates, and continuous improvement across the security operations center.