Incident Response Analyst (Mid-Senior Level)

Toyota Tsusho Systems US, Inc.; Plano (TX); Presencial; USD 95.000 - 130.000; Jornada completa

Descripción de la vacante

Toyota Tsusho Systems US, Inc. is seeking an Incident Response Analyst to join the TRRAC team. You will lead IR activities, perform forensics across multiple platforms, and drive threat hunting and intelligence initiatives.

You will collaborate with the 24/7 SOC, vulnerability management, and insider risk teams, developing playbooks and training materials while staying current on emerging threats. This role requires on-site presence in Plano, TX.

Formación

• 3–5 years of hands-on incident response and digital forensics experience.
• Proven Incident Commander experience in high-pressure incidents.
• Strong knowledge of Windows, Linux, and macOS internals for monitoring and threat detection.
• Experience with cloud security incident response and threat mitigation.
• Malware analysis (behavioral and static) and basic cryptanalysis.
• Familiarity with security frameworks (NIST, HIPAA, ISO, OWASP, etc.).
• Proficient with DFIR tools (Autopsy, The Sleuth Kit, Volatility, Magnet Axiom, FTK, etc.).
• Scripting in Python, PowerShell, and Bash for automation.
• Excellent communication across technical teams and stakeholders.

Responsabilidades

• Conduct incident response per NIST CSF across all phases.
• Respond to cyber incidents affecting corporate environments, plants, third parties, dealerships, and RSOC customers.
• Perform digital forensics on Windows, Linux, macOS, and mobile devices.
• Maintain an Always Be Timelining (ABT) approach with active timelines.
• Support threat hunting and threat intelligence activities.
• Analyze emerging threats, attacker TTPs, and track threat actors.
• Collaborate with the 24/7 SOC and other teams.
• Prepare forensic reports, incident communications, and executive updates.
• Participate in weekly on-call rotation for 24/7 incident coverage.
• Conduct malware analysis (behavioral and static).
• Help develop, refine, and maintain IR playbooks and SOPs.
• Participate in tabletop exercises to test workflows.
• Stay current on threats and industry best practices.

Conocimientos

Windows/Linux/macOS internals

Cloud security incidents

Threat hunting

Python/PowerShell/Bash

Communication skills

Educación

Bachelor's degree in Cybersecurity/IT/CS

Herramientas

Autopsy

The Sleuth Kit

Volatility

Magnet Axiom

FTK

Descripción del empleo

Founded in 2011, Toyota Tsusho Systems US, Inc. (TTS-US) is a Toyota group company, that develops IT solutions wherever global businesses operate. Transforming into a technology and mobility company, TTS-US with its 8 TTS affiliates worldwide is establishing a secure and resilient Toyota global value chain. The creative capacity to forge such limitless business opportunities is one of the strengths of Toyota Tsusho Systems.

We are seeking a skilled and experienced Incident Response Analyst to join our collaborative cybersecurity incident response team within the Threat Research, Response & Analysis Center (TRRAC). In this role, you will combine technical expertise in digital forensics and incident response with proactive threat intelligence and hunting activities. You will respond to critical security incidents across the ecosystem, conduct comprehensive forensic investigations, and collaborate closely with the 24/7 SOC and other cybersecurity teams. When not actively responding to incidents, you will contribute to threat hunting, cyber threat intelligence, tooling improvements, and the development of SOPs and training materials—helping to elevate the entire team's capabilities.

Essential Functions

• Conduct comprehensive incident response activities following the NIST Cybersecurity Framework across all phases: Initial Detection, Analysis & Validation, Containment, Eradication, Recovery, and Post-Incident Activity
• Respond to cyber incidents impacting corporate environments, manufacturing plants, third-parties, dealerships, and RSOC Customers
• Perform digital forensic investigations including collection, processing, and analysis of forensic evidence from diverse devices (Windows, Linux, macOS, mobile)
• Maintain an "Always Be Timelining" (ABT) approach, continuously updating incident timelines as findings are discovered
• Support proactive, reactive, and exploratory threat hunting activities across the ecosystem
• Analyze emerging cyber threats, attacker TTPs, and track threat actors/groups to anticipate and mitigate potential attacks
• Collaborate closely with the 24/7 SOC, Threat Detection Engineering, Vulnerability Management, and Insider Risk Management teams
• Prepare and deliver forensic reports, incident communications, and executive updates during active incidents
• Participate in weekly on-call rotation schedule for 24/7 incident response coverage
• Conduct malware analysis (behavioral and static) using TRRAC Labs' dynamic analysis capabilities
• Help develop, refine, and maintain incident response playbooks, SOPs, and training materials to improve team effectiveness
• Participate in quarterly tabletop exercises to test incident response workflows and controls
• Stay current on emerging threats, attacker techniques, and industry best practices

Requirements

• Minimum of 3-5 years of hands-on experience in incident response and digital forensics
• Proven ability to act as Incident Commander within a team setting during high-pressure incidents
• Strong technical expertise in Windows, Linux, and macOS internals related to monitoring and threat detection
• Experience with cloud security incident response and threat mitigation
• Skilled in malware analysis (behavioral and static) and basic cryptanalysis
• Familiarity with security frameworks and compliance standards (NIST, HIPAA, ISO, OWASP, etc.)
• Proficient with DFIR tools such as Autopsy, The Sleuth Kit, Volatility, Magnet Axiom, FTK, and others
• Competent in scripting languages like Python, PowerShell, and Bash for automation and analysis
• Excellent communication skills with the ability to collaborate effectively across technical teams and stakeholders

Preferred / Bonus Skills

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field (preferred or equivalent experience)
• Experience in enterprise, manufacturing, or software industries
• Familiarity with SOAR platforms and security automation
• Prior experience contributing to or improving incident response programs in a team environment

Why Join Us?

• Be part of a skilled, collaborative incident response team where your expertise helps drive collective success
• Lead and support incident response efforts alongside experienced peers
• Continuously grow your skills through diverse investigations, threat hunting, and team knowledge sharing
• Help shape and improve our incident response processes and training