Cybersecurity Incident Response Lead

STOKE Space Technologies; Kent (WA); On-site; USD 134,000 - 200,000; Full time

Benefits offered by this job

Equity in Stoke Space

Medical insurance

401(k) with match

Paid time off

Holidays

Parental leave

Wellness stipend

Dog-friendly offices

Job summary

Stoke Space is seeking a Cybersecurity Incident Response Lead to own detection, investigation, containment, and recovery of incidents across our aerospace infrastructure, engineering environments, manufacturing systems, and sensitive data.

This hands‑on technical leadership role involves coordinating responders, mentoring teams, and translating findings into practical improvements that strengthen our security posture while balancing safety and rapid recovery in a fast‑paced startup environment.

Qualifications

• 5+ years of cybersecurity operations, incident response, or digital forensics experience
• Ability to lead complex security incidents across multiple teams
• Strong Windows/Linux, IAM, and cloud knowledge
• Experience with SIEM/EDR, log correlation, and evidence preservation
• Ability to automate analysis with KQL, Python, PowerShell, or Bash
• Excellent written and verbal communication and stakeholder briefing skills
• Ability to mentor and lead cross-functional teams across org boundaries

Responsibilities

• Lead cybersecurity incidents from triage to containment and recovery; set priorities and escalation paths
• Coordinate responders, assign actions, maintain records, and communicate risks
• Investigate endpoint, identity, network, cloud, and app activity to reconstruct timelines
• Preserve logs and evidence with proper handling and chain of custody
• Coordinate containment with system owners while aligning with safety requirements
• Maintain incident response playbooks, escalation procedures, and run tabletop exercises
• Improve detection and response with SIEM/EDR, threat intel, and automation
• Provide updates and clear reports on findings, actions, and risks
• Lead cross‑team collaboration with leadership, legal, and external partners
• Mentor responders and participate in on‑call and after‑hours response
• Perform additional duties to support organizational goals

Skills

Incident response leadership

Cybersecurity operations

Threat hunting

Communication

Education

Bachelor's degree in Cybersecurity

Tools

SIEM

EDR

Forensics

Job description

At Stoke, we believe a thriving space economy will enable a vibrant, sustainable, and equitable future here on Earth. That is why we’re building Nova, our fully and rapidly reusable launch vehicle. Designed for daily flight, Nova tackles the core challenges of space transportation by reducing cost, increasing availability, and improving reliability. By radically lowering launch costs and increasing flight cadence, we’re helping create a truly scalable space industry.

Our team is mission-driven, collaborative, and empowered to take ownership of their work. If you want to work alongside some of the most dedicated and talented people on Earth, we’d love to have you join us.

Description

Reusable launch systems depend on secure, resilient information systems. As a Cybersecurity Incident Response Lead, you will lead the detection, investigation, containment, and recovery of cybersecurity incidents affecting Stoke’s infrastructure, engineering environments, manufacturing systems, and sensitive aerospace data.

This is a hands-on technical leadership role with ownership of incident response readiness and execution. You will lead complex investigations, coordinate response across teams, and translate findings into practical improvements that reduce risk and strengthen our ability to respond. You will provide technical direction and mentorship while working closely with IT, security, software engineering, manufacturing, and operations.

We are a small, highly motivated team. You will balance decisive response with operational safety and continuity, keeping technical teams and leadership informed as incidents evolve. You must be ready to stay focused, move fast, self-direct, and learn on the fly.

Responsibilities

• Lead cybersecurity incidents from initial triage through containment, eradication, recovery, and closure; establish severity, scope, response priorities, and escalation paths
• Serve as the technical incident lead, coordinating responders, assigning actions, maintaining decision records, and escalating business risks and resource needs
• Investigate endpoint, identity, network, cloud, and application activity to reconstruct timelines, identify initial access and persistence, and assess affected systems and data
• Collect and preserve logs, forensic artifacts, and other evidence with documented handling, chain of custody, and appropriate access controls
• Coordinate containment and recovery with system owners, validating remediation and monitoring for recurrence; align actions affecting manufacturing, test, or launch systems with operational and safety requirements
• Maintain the incident response plan, escalation procedures, and playbooks for scenarios such as compromised accounts, ransomware, data exfiltration, and cloud compromise
• Improve detection coverage and response workflows using SIEM, endpoint detection and response, threat intelligence, and automation; identify telemetry gaps and tune alerts
• Conduct threat hunting and translate investigation findings into detection rules, control improvements, and prioritized remediation with accountable owners
• Provide clear incident updates and reports that distinguish confirmed findings from uncertainty and explain business impact, response actions, and outstanding risks
• Coordinate with leadership, legal, compliance, and external response partners to support evidence requests and applicable notification obligations
• Lead tabletop exercises and post-incident reviews; track corrective actions and measure response effectiveness, readiness, and recurring failure patterns
• Mentor responders, maintain investigation standards, and participate in on-call coverage and after-hours response for critical incidents
• Perform additional duties as assigned to support organizational goals and objectives

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent practical experience
• 5+ years of experience in cybersecurity operations, incident response, digital forensics, or a related technical field, including hands‑on leadership of complex security incidents
• Demonstrated ability to investigate and contain security incidents, determine scope and impact, and coordinate recovery across multiple technical teams
• Strong understanding of Windows and Linux systems, identity and access management, networking, cloud infrastructure, and common attacker techniques
• Hands‑on experience with SIEM and endpoint detection and response platforms, log correlation, forensic triage, and evidence preservation
• Ability to write investigation queries and automate repeatable analysis or response tasks using tools such as KQL, Python, PowerShell, or Bash
• Sound judgment under pressure, including the ability to prioritize actions based on threat activity, business impact, and operational constraints
• Clear written and verbal communication skills, with experience producing investigation reports and briefing technical and nontechnical stakeholders
• Ability to lead through influence, mentor colleagues, and drive corrective actions to closure across organizational boundaries

Preferred Qualifications

• Experience with Microsoft Sentinel, Defender, Entra ID, Microsoft 365, and investigations in AWS or Azure environments
• Experience with disk and memory forensics, malware triage, threat hunting, or investigations involving ransomware, identity compromise, and data theft
• Experience building an incident response program, running exercises, or coordinating external incident response providers
• Familiarity with MITRE ATT&CK and incident response practices aligned with NIST; experience supporting NIST 800-53/171, FedRAMP, ISO 27001, SOC 2, or CUI protection requirements
• Experience supporting aerospace, manufacturing, operational technology, or other environments where response actions must account for safety and availability
• Relevant certifications such as GCIH, GCFA, GCFE, or equivalent demonstrated expertise
• Prior experience in a startup environment, demonstrating adaptability, resourcefulness, and a hands‑on approach to security

Benefits

• Equity – We know that our employees are the reason we succeed. To give everyone a stake in our future, we are pleased to offer equity in the form of stock options to all regular, full‑time employees.
• Comprehensive benefits program including subsidized medical, dental, and vision insurance
• Company‑paid life and disability insurance
• 401(k) plan with employer match
• 4 weeks’ Paid Time Off
• Holidays – 11 days (including an end‑of‑year closure)
• Paid Family/Parental Leave
• On‑site gym or monthly wellness stipend (depending on location)
• Dog friendly offices!

Compensation

Target Levels:

• Level 3 Range: $133,560 - $200,340
• Level 4 Range: $160,230 - $240,450

Our job posts are intentionally written to attract a wide variety of experience levels, and we make decisions about the right fit on a per‑candidate basis.

Your actual level and base salary will be decided based on your specific experience and skill level.

ITAR Requirements

To conform to U.S. Government space technology export regulations, including the International Traffic in Arms Regulations (ITAR), you must be a U.S. citizen, lawful permanent resident of the U.S. (i.e., current Green Card holder), or protected individual as defined by 8 U.S.C. 1324b(a)(3).

Equal Opportunity

The Company is an Equal Opportunity Employer, including with respect to disability and veteran status. It is committed to compliance with all equal opportunity laws, including the Immigration and Nationality Act (INA) and Title VII. It does not discriminate on the basis of nationality, race, citizenship, immigration status, or any other protected class when it comes to employment practices, including hiring.

Employment at the Company is contingent upon satisfactory completion of reference and backgroundchecks, and on your ability to prove your identity and authorization to work in the U.S. for the Company. Employees must comply with the United States Citizenship and Immigration Services employment verification requirements, and, therefore, they must complete an Employment Eligibility Verification Form I-9 at the start of employment and re-verify authorization to work periodically.

Separate from this I-9 process, as noted above, this position entails access to certain technology and technical data that is restricted under U.S. export control laws and regulations. Employment or continued employment may be conditioned on your legal authorization to work with or have access to export control materials as necessary to perform your job.

Candidate Rights & Accommodations

If you require a reasonable accommodation to complete the application or participate in the interview process, please contact [e-mail]. Requests will be handled in accordance with applicable laws. Please do not include medical or other confidential information in your initial request.

For more information about your rights, please refer to the "Know Your Rights" notice here.

E-Verify

Stoke Space uses E-Verify to confirm the identity and employment eligibility of all new hires.

For more information on the right to work, please refer to the poster here.