Incident Response Analyst - Americas

The Carlyle Group; Washington (District of Columbia); On-site; USD 120,000 - 180,000; Full time

Job summary

The Carlyle Group is seeking an experienced Incident Response Analyst to join its Security Operations Center. You will investigate, contain, and remediate security incidents across endpoints, identities, networks, and cloud environments, leveraging SIEM, XDR, and EDR tools.

You will drive automation to accelerate investigations while maintaining human oversight. Ideal candidates have 5+ years in IT/security, strong incident response methodologies, and experience with cloud platforms (AWS/Azure)

Qualifications

• Four-year college degree, or equivalent years' of relevant experience, required.
• Certifications in incident response (GCIH, SANS) or security (CISSP, CCSP) preferred.

Responsibilities

• Analyze, investigate, document, contain, remediate, and coordinate response to cybersecurity incidents.
• Serve as escalation point for security events requiring deeper analysis and response.
• Develop, test, tune, and improve detection logic and analytics.
• Identify opportunities to automate enrichment, evidence collection, and containment actions.
• Develop and maintain incident response playbooks and procedures.
• Produce operational metrics and reporting related to incident response and SOC performance.
• Mentor team members and share knowledge to improve SOC capabilities.

Skills

Incident response

Threat hunting

Automation

Security mindset

Education

Bachelor's degree or equivalent

Tools

Palo Alto XSIAM

SIEM tools

AWS

Azure

Terraform

CloudFormation

Python

Bash

PowerShell

EDR

Windows

Linux

macOS

Job description

The Carlyle Group (NASDAQ: CG) is a global investment firm with $485 billion of assets under management, across 678 investment vehicles as of June 30, 2026. Founded in 1987 in Washington, DC, Carlyle has grown into one of the world's largest and most successful investment firms, with more than 2,500 professionals operating in 28 offices in North America, Europe, the Middle East, Asia and Australia.

Carlyle's purpose is to connect people, ideas, and capital to fuel growth for companies and performance for investors, which range from public and private pension funds to wealthy individuals and families to sovereign wealth funds, unions and corporations. Carlyle invests across three segments - Global Private Equity, Global Credit and Carlyle AlpInvest - and has deep expertise across industries, markets, and geographies.

At Carlyle, we believe that a wide spectrum of experiences and viewpoints drives performance and success. Our CEO, Harvey Schwartz, has stated that, "To build better businesses and create value for all of our stakeholders, we are focused on assembling leadership teams with the strongest insights from a range of perspectives." Reflecting this view, emphasis is placed on development, retention and inclusion through our internal processes and seven Employee Resource Groups (ERGs). We cultivate a culture where ideas are openly shared and challenged, connecting diverse expertise and perspectives to drive enduring value.

Position Summary

The Incident Response Analyst plays a critical role in protecting the organization's information, technology platforms, and sensitive financial data from increasingly sophisticated cyber threats. This is a hands-on technical position within the Security Operations Center (SOC), responsible for investigating, containing, and resolving security incidents across endpoint, identity, network, cloud, SaaS, and enterprise environments. The successful candidate will combine strong cybersecurity fundamentals with modern detection, investigation, automation, and threat analysis capabilities to rapidly identify malicious activity and reduce organizational risk.

The ideal candidate will possess a strong understanding of incident response, security operations, threat detection, threat hunting, and digital investigation methodologies. They will take ownership of security incidents throughout the response lifecycle, including triage, investigation, containment, eradication, recovery, and post-incident analysis. The analyst will correlate and analyze telemetry from multiple security technologies-including SIEM, XDR, EDR, identity, network, cloud, email, and data protection platforms-to reconstruct attack activity, determine scope and impact, identify root cause, and recommend appropriate remediation actions. Familiarity with contemporary attack techniques and frameworks such as MITRE ATT&CK is essential for understanding adversary behavior and improving detection and response capabilities.

This role will be an advocate for an automation-first SOC. The Incident Response Analyst will leverage security orchestration, scripting, APIs, automation platforms, and increasingly AI-assisted security capabilities to accelerate investigations and reduce repetitive manual activities. The analyst should be comfortable identifying opportunities to automate enrichment, evidence collection, alert triage, containment actions, case management, and other repeatable incident response processes while maintaining appropriate human oversight for high-impact decisions.

As enterprise environments increasingly span traditional infrastructure and cloud services, the analyst must understand modern attack surfaces across endpoints, identities, networks, cloud infrastructure, SaaS platforms, applications, and data environments. Knowledge of cloud security concepts, identity-based attacks, credential compromise, privilege escalation, lateral movement, data exfiltration, ransomware, phishing, malware, and emerging AI-enabled threats will be important to effectively investigate and respond to modern cyberattacks.

The Incident Response Analyst will also contribute to the continuous improvement of the SOC by performing threat hunting, detection engineering, incident retrospectives, playbook development, and security control optimization. Lessons learned from investigations should be translated into improved detections, automated workflows, response procedures, and preventative controls. The analyst will work closely with security engineering, threat intelligence, vulnerability management, identity, cloud, infrastructure, application security, and other technology teams to strengthen the organization's overall detection and response capabilities.

Primary Responsibilities

Security Incident Response

• Analyze, investigate, document, contain, remediate, and coordinate response to cybersecurity incidents across endpoint, identity, network, cloud, SaaS, email, application, and data environments. Maintain ownership of incidents through resolution and ensure appropriate escalation, communication, evidence preservation, and documentation throughout the incident lifecycle.

SOC Escalation and Advanced Investigation

• Serve as an escalation point for security events referred by the Tier 1 Managed Security Service Provider (MSSP) that require deeper technical analysis, validation, or response. Correlate telemetry across multiple security platforms to determine attack scope, root cause, affected identities and assets, potential business impact, and required containment or remediation actions.

Detection Engineering

• Develop, test, tune, and continuously improve detection logic, correlation rules, analytics, queries, and behavioral detections designed to identify advanced and emerging threats. Translate lessons learned from incidents and threat hunting activities into improved detection and prevention capabilities.

Security Automation and AI-Assisted Operations

• Identify opportunities to automate repetitive investigation and response activities using scripting, APIs, security orchestration, workflow automation, and AI-assisted security technologies. Develop and improve automated workflows for alert enrichment, evidence collection, investigation, case management, containment, and remediation while maintaining appropriate human oversight.

Incident Response Playbooks

• Develop, maintain, test, and continuously improve incident response playbooks and operational procedures for common and high-impact security scenarios, including compromised accounts, phishing, malware, ransomware, data exfiltration, insider threats, cloud compromise, and other emerging attack techniques.

Metrics and Reporting

• Develop and maintain meaningful operational metrics and reporting related to incident response, detection effectiveness, threat hunting, automation, project deliverables, and SOC performance. Use operational data to identify trends and opportunities to improve detection coverage, response time, and overall security effectiveness.

Continuous Learning and Technical Leadership

• Maintain and expand technical expertise through research, hands-on lab work, threat research, training, industry engagement, and professional development. Share knowledge with other analysts, mentor team members, document technical findings, and contribute to improving the overall capabilities and maturity of the Security Operations Center.

Requirements

Education & Certificates

• Four-year college degree, or equivalent years' of relevant experience, required.
• Certifications in incident response (GCIH, SANS) or security (CISSP, CCSP) preferred.

Professional Experience

• 5+ years of overall IT-related experience, required.
• 3+ years of IT security operations and incident response experience, required.
• Knowledge of financial services industry and alternative asset management, strongly preferred.
• In-depth knowledge of incident response methodologies (identify, contain, eradicate, recover, learn).
• Proven ability to conduct investigations, analyze evidence, and identify root causes of security incidents.
• Experience with digital forensics and evidence collection techniques in various environments (cloud, network, endpoint).
• Experience with leveraging APIs to automate integrations between security tools.
• Knowledge of cloud security best practices (IAM, encryption, logging).
• Ability to prioritize tasks, manage multiple incidents concurrently, and work effectively under pressure.
• Strong analytical and problem-solving skills to diagnose complex security incidents.
• Excellent communication and collaboration skills to work effectively with security teams, IT teams, and business stakeholders.

Position-specific Technical Requirements

• Proficiency with security orchestration, automation and response (SOAR) platforms (Palo Alto XSIAM).
• Proficiency with security information and event management (SIEM) tools
• Proficiency with at least one major cloud platform (AWS, Azure)
• Familiarity with Infrastructure as Code (IaC) tools (Terraform, CloudFormation).
• Experience with scripting languages (Python, Bash, PowerShell) for automating incident response tasks.
• Strong understanding of network security concepts (firewalls, intrusion detection/prevention systems).
• Proficiency with endpoint security tools (antivirus, endpoint detection and response (EDR), Application Control.
• Working knowledge of various operating systems (Windows, Linux, macOS).