Incident Response Analyst

Themesoft Inc.; New York (NY); On-site; USD 90,000 - 130,000; Full time

Job summary

The role at Themesoft Inc focuses on incident response and threat management within the CrowdStrike Falcon ecosystem. You will handle frontline triage, evidence collection, and remediation coordination to protect data and IP across devices and networks.

You will also contribute to playbooks, analyze threat data, and collaborate with Infrastructure, Applications, and external vendors to strengthen security posture.

Qualifications

• Document evidence throughout the incident life cycle.
• Triage ticket queue: prioritization, assignment and disposition.
• Front-line triage and response with containment actions.
• Update SOAR playbooks and runbooks.
• Coordinate remediation after findings and review vendor controls.

Responsibilities

• Document evidence throughout the incident life cycle, conducting shift handovers, escalating security events to incident response, and providing support during cyber security incidents.
• Triage the ticket queue: prioritization, assignment and disposition of security incident tickets/events.
• Analyze threat data from multiple sources and build evidence-backed dispositions.
• Containment and remediation actions such as network isolation and blocking indicators of compromise.
• Maintain detailed case activity reports in the case management tool to verify process adherence.
• Contribute to creation and updating of SOAR playbooks and runbooks and general response documentation.
• Monitor detection and response programs to protect data and IP.
• Hunt for, detect, and respond to malicious activity on devices and networks.
• Use tools to automate detection and address future vulnerabilities.
• Coordinate remediation efforts after findings outline weaknesses.
• Work with security architecture to integrate TM tools into design reviews.
• Review third-party information security controls and document gaps for action.
• Document and enforce security improvements balancing risk with business operations.
• Foster cross-functional relationships with Infrastructure, Applications, and vendors.

Skills

Incident response

Threat hunting

SOAR playbooks

Threat data analysis

Tools

CrowdStrike Falcon

Job description

Would need to understand the broader Crowdstrike Falcon ecosystem. Would also need to understand to understand sensor management, policy configuration. Perform the Incident Response support along with client team and SOC provider.

Key activities include:

• Responsible for documenting evidence throughout the incident life cycle, conducting shift handovers, escalating security events to incident response, and providing support during cyber security incidents
• Responsible for the ticket queue triage: prioritization, assignment and disposition of security incident tickets/events.
• Responsible for analyzing threat data from multiple sources and building evidence backed dispositions.
• Responsible for front line triage and response including some containment and remediation actions such as network isolation of hosts and blocking indicators of compromise within security perimeter tools.
• Analyst must keep detailed reports on all analysis activity, documented in the case management tool to validate process adherence.
• Responsible for contributing to the creation and updating of new and existing SOAR playbooks and runbooks and general response documentation.
• Monitor security detection and response program to protect Data and IP from both internal and external threats
• Hunt for, detect, and respond to malicious activity and anomalous events on devices and networks
• Utilize tools to automate detection and automatically find and address future vulnerabilities
• Manage/coordinate remediation efforts after security assessment findings outline weaknesses requiring attention.
• Working with the threat modelling lead in Security Architecture to integrate TM tools into the Security Design Review Process.
• Review Vendor software/hardware and Third-Party information security integration controls/risks and document gaps and issues for action.
• Document, formulate and enforce areas of security improvement that balance risk with business operations and do not diminish efficiencies or innovation.
• Foster strong cross-functional relationships internally between Infrastructure, Application teams and external vendors.