Cyber Triage Lead: Forensics & Incident Response

Ernst & Young Oman; Salt Lake City (UT); Hybrid; USD 91,000 - 170,000; Full time

Benefits offered by this job

Total Rewards package

Flexible vacation policy

Hybrid work model

Medical and dental coverage

401(k) plans

Job summary

EY is seeking a CTF Shift Lead to manage the Cyber Triage and Forensics team, guiding junior and senior analysts, and ensuring swift threat response. The role includes leadership, performance management, and collaboration with global stakeholders.

Ideal candidates will have a strong SOC background, expertise in security event triage, and a commitment to secure, compliant operations within EY's hybrid US environment.

Qualifications

• Bachelor's degree or equivalent in CS/Info Security.
• 4–5 years in Security Monitoring/SOC environment.
• Experience with log correlation and electronic investigations.
• Linux and Windows system administration knowledge.
• Scripting or programming skills in common languages.

Responsibilities

• Oversee day-to-day operations of CTF Analysts.
• Ensure prompt responses to email and case queues.
• Distribute workload among threat hunting team.
• Participate in analysis and triage of security events.
• Provide technical leadership and mentorship to junior analysts.
• Set clear performance expectations and manage team.
• Report case status and significant incident updates to the global lead.
• Update SOPs and drive continuous improvement within the team.

Skills

Network & endpoint security

Defense in depth

Information security principles

SIEM platforms

TCP/IP & IDS/IPS

Professional integrity

Communication & writing

Linux & Windows administration

Scripting/Programming

Education

Bachelor's degree in Computer Science or Information Security

Tools

Active Directory

SIEM Platforms

Job description

EY is seeking a CTF Shift Lead to manage the Cyber Triage and Forensics team, guiding junior and senior analysts, and ensuring swift threat response. The role includes leadership, performance management, and collaboration with global stakeholders.

Ideal candidates will have a strong SOC background, expertise in security event triage, and a commitment to secure, compliant operations within EY's hybrid US environment.