Cybersecurity Incident Response Lead | Equity Eligible

Stoke Space; Kent (WA); Presencial; USD 134.000 - 240.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Equity – stock options

Company-paid life and disability

401(k) with employer match

Holidays – 11 days (end-of-year close)

On-site gym or wellness stipend

Dog friendly offices

Descripción de la vacante

Stoke Space seeks a Cybersecurity Incident Response Lead to own incident detection, investigation, containment, and recovery affecting its cyber-physical and IT infrastructure. You will head complex investigations, coordinate across IT, security, software, manufacturing, and operations, and drive improvements to reduce risk while mentoring teammates.

This hands-on technical leadership role emphasizes rapid, safe decision-making, readiness, and robust incident playbooks to protect launch-critical

Formación

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent practical experience
• 5+ years of experience in cybersecurity operations, incident response, digital forensics, or a related technical field, including hands‑on leadership of complex security incidents
• Demonstrated ability to investigate and contain security incidents, determine scope and impact, and coordinate recovery across multiple technical teams
• Strong understanding of Windows and Linux systems, identity and access management, networking, cloud infrastructure, and common attacker techniques
• Hands‑on experience with SIEM and endpoint detection and response platforms, log correlation, forensic triage, and evidence preservation
• Ability to write investigation queries and automate repeatable analysis or response tasks using tools such as KQL, Python, PowerShell, or Bash
• Sound judgment under pressure, including the ability to prioritize actions based on threat activity, business impact, and operational constraints
• Clear written and verbal communication skills, with experience producing investigation reports and briefing technical and nontechnical stakeholders
• Ability to lead through influence, mentor colleagues, and drive corrective actions to closure across organizational boundaries

Responsabilidades

• Lead cybersecurity incidents from initial triage through containment, eradication, recovery, and closure; establish severity, scope, response priorities, and escalation paths
• Serve as the technical incident lead, coordinating responders, assigning actions, maintaining decision records, and escalating business risks and resource needs
• Investigate endpoint, identity, network, cloud, and application activity to reconstruct timelines, identify initial access and persistence, and assess affected systems and data
• Collect and preserve logs, forensic artifacts, and other evidence with documented handling, chain of custody, and appropriate access controls
• Coordinate containment and recovery with system owners, validating remediation and monitoring for recurrence; align actions affecting manufacturing, test, or launch systems with operational and safety requirements
• Maintain the incident response plan, escalation procedures, and playbooks for scenarios such as compromised accounts, ransomware, data exfiltration, and cloud compromise
• Improve detection coverage and response workflows using SIEM, endpoint detection and response, threat intelligence, and automation; identify telemetry gaps and tune alerts
• Conduct threat hunting and translate investigation findings into detection rules, control improvements, and prioritized remediation with accountable owners
• Provide clear incident updates and reports that distinguish confirmed findings from uncertainty and explain business impact, response actions, and outstanding risks
• Coordinate with leadership, legal, compliance, and external response partners to support evidence requests and applicable notification obligations
• Lead tabletop exercises and post‑incident reviews; track corrective actions and measure response effectiveness, readiness, and recurring failure patterns
• Mentor responders, maintain investigation standards, and participate in on‑call coverage and after‑hours response for critical incidents
• Perform additional duties as assigned to support organizational goals and objectives

Conocimientos

Leadership

Incident response

Threat hunting

Communication

Mentorship

Educación

Bachelor’s degree in Cybersecurity or related field

Herramientas

SIEM

EDR

KQL

Python

PowerShell

Bash

Descripción del empleo

Stoke Space seeks a Cybersecurity Incident Response Lead to own incident detection, investigation, containment, and recovery affecting its cyber-physical and IT infrastructure. You will head complex investigations, coordinate across IT, security, software, manufacturing, and operations, and drive improvements to reduce risk while mentoring teammates.

This hands-on technical leadership role emphasizes rapid, safe decision-making, readiness, and robust incident playbooks to protect launch-critical