Incident Response Analyst - Security Event Investigation

The Elite Job; Vermilion (OH); On-site; USD 70,000 - 100,000; Full time

Benefits offered by this job

Competitive compensation

Professional development

Support for cybersecurity certs

Flexible work arrangements

Paid leave

Job summary

The Elite Job is seeking an Incident Response Analyst to join our cybersecurity team. The role focuses on identifying, investigating, and responding to security incidents across systems, networks, and data.

You will monitor alerts, perform root-cause analysis, coordinate containment, document findings, and communicate risk to technical and non‑technical stakeholders. On-site or hybrid work options may be available to fit operational needs.

Qualifications

• Strong fundamentals in cybersecurity concepts and controls.
• Experience with security monitoring, incident detection, and containment.
• Familiarity with SIEM/EDR tools and threat intel.
• Understanding of Windows and Linux OS, logs, and auth events.
• Knowledge of incident response frameworks and playbooks.

Responsibilities

• Monitor security alerts and correlate logs to identify incidents.
• Investigate security events, determine root cause, and document findings.
• Coordinate containment, eradication, and recovery activities.
• Perform threat analysis using IOCs, files, IPs, and domains.
• Prepare incident reports and communicate with stakeholders.
• Work with cross‑functional teams to improve detection and response.

Skills

Cybersecurity fundamentals

SIEM experience

EDR familiarity

Windows OS

Linux OS

Networking concepts

Incident response lifecycle

Threat intelligence

MITRE ATT&CK

Communication

Education

Bachelor's degree in Cybersecurity/IT/CS/IS

Tools

Microsoft Sentinel

Splunk

IBM QRadar

Job description

1. Job Summary

The Elite Job is seeking a detail-oriented and analytical Incident Response Analyst – Security Event Investigation to join our cybersecurity team. The successful candidate will play a critical role in identifying, investigating, analyzing, and responding to cybersecurity incidents that may threaten organizational systems, networks, applications, and sensitive information.

In this role, you will monitor security alerts, investigate suspicious activities, analyze potential threats, and coordinate incident response activities to minimize operational disruption and reduce security risks. You will work with security operations teams, IT administrators, network engineers, and other relevant stakeholders to investigate security events, determine their root causes, and implement appropriate containment and remediation measures.

The ideal candidate will have a strong understanding of cybersecurity principles, security monitoring tools, incident handling procedures, and threat investigation techniques. You should be comfortable analyzing technical evidence, documenting investigation findings, prioritizing security incidents, and communicating recommendations to technical and non‑technical stakeholders.

This position offers an opportunity to contribute to the organizations security posture while developing expertise in threat detection, digital investigations, incident management, and cybersecurity risk reduction.

2. Key Responsibilities

• Security Event Monitoring: Monitor security alerts, logs, endpoint activities, network traffic, and system events to identify suspicious behavior and potential cybersecurity incidents.
• Incident Investigation: Investigate security events involving unauthorized access, malware infections, phishing attacks, suspicious login attempts, data exposure, and other potential threats.
• Alert Triage and Prioritization: Assess incoming security alerts, determine their severity and potential business impact, and prioritize investigations according to established incident response procedures.
• Threat Analysis: Analyze indicators of compromise (IOCs), suspicious files, IP addresses, domains, authentication events, and other relevant evidence to determine whether malicious activity has occurred.
• Incident Containment: Collaborate with relevant technical teams to contain confirmed incidents, isolate affected endpoints, disable compromised accounts, and restrict suspicious network activity when authorized.
• Root Cause Analysis: Identify the likely entry point, attack method, affected assets, and contributing security weaknesses associated with confirmed incidents.
• Security Information and Event Management: Use SIEM platforms to correlate security logs, investigate event patterns, identify anomalies, and support effective threat detection.
• Endpoint Detection and Response: Review endpoint security alerts and investigate potentially malicious processes, unusual system behavior, and unauthorized changes.
• Phishing Investigation: Examine suspicious emails, attachments, URLs, sender information, and related user activity to determine whether phishing attempts pose a security risk.
• Digital Evidence Handling: Collect, preserve, and document relevant security evidence in accordance with internal procedures and applicable legal or regulatory requirements.
• Incident Documentation: Maintain accurate incident records, investigation timelines, evidence references, response actions, findings, and recommendations.
• Cross-Functional Coordination: Work with IT operations, infrastructure, application security, identity and access management, and compliance teams to resolve incidents effectively.
• Threat Intelligence: Review relevant threat intelligence reports and indicators to understand emerging attack techniques and improve investigation capabilities.
• Vulnerability Identification: Identify security weaknesses revealed during incident investigations and recommend appropriate corrective measures.
• Incident Recovery Support: Assist technical teams in validating remediation activities, restoring affected systems, and confirming that identified threats have been addressed.
• Post-Incident Reviews: Participate in lessons‑learned sessions and recommend improvements to detection rules, response playbooks, security controls, and escalation procedures.
• Reporting and Communication: Prepare clear incident summaries, technical investigation reports, and management updates that communicate risks, findings, and recommended actions.
• Continuous Improvement: Support the development and refinement of incident response procedures, investigation checklists, security monitoring practices, and operational documentation.
• Security Awareness: Share relevant investigation insights with appropriate teams to help prevent recurring incidents and strengthen organizational security awareness.

3. Required Skills and Qualifications

Bachelors degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related discipline; equivalent practical experience may also be considered.

• Strong understanding of cybersecurity fundamentals, including confidentiality, integrity, availability, authentication, authorization, and access control.
• Knowledge of common cyberattacks, including phishing, ransomware, credential theft, malware, brute‑force attacks, privilege escalation, and unauthorized access.
• Familiarity with security monitoring, incident detection, investigation, containment, eradication, and recovery processes.
• Experience using or working with SIEM platforms such as Microsoft Sentinel, Splunk, IBM QRadar, or comparable security monitoring solutions.
• Familiarity with endpoint detection and response (EDR) tools and endpoint security technologies.
• Understanding of Windows and Linux operating systems, system logs, authentication events, and common administrative activities.
• Basic knowledge of networking concepts, including TCP/IP, DNS, HTTP/HTTPS, VPNs, firewalls, and network traffic analysis.
• Ability to interpret security logs and correlate information from multiple sources to investigate suspicious activity.
• Knowledge of incident response frameworks and established cybersecurity practices.
• Familiarity with threat intelligence, indicators of compromise, and common attack frameworks such as MITRE ATT&CK.
• Strong analytical, troubleshooting, and critical‑thinking abilities.
• Excellent written and verbal communication skills.
• Strong attention to detail and the ability to maintain accurate investigation records.
• Ability to manage competing priorities and respond effectively to time‑sensitive security incidents.
• Commitment to confidentiality, ethical conduct, and responsible handling of sensitive information.
• Relevant certifications such as CompTIA Security+, CompTIA CySA+, GIAC Certified Incident Handler (GCIH), or equivalent cybersecurity credentials are desirable but not mandatory unless required for a particular assignment.

4. Experience

Candidates with different levels of cybersecurity experience may be considered according to the requirements of the position.

Preferred experience includes:

• Approximately 1–3 years of experience in cybersecurity, security operations, IT security, incident investigation, or a related technical role.
• Practical experience monitoring security alerts and investigating suspicious system or network activities.
• Exposure to SIEM dashboards, security event correlation, log analysis, and incident ticketing systems.
• Experience investigating phishing emails, suspicious authentication attempts, endpoint alerts, or potential malware activity.
• Familiarity with incident escalation processes and collaboration with IT teams to resolve security issues.
• Experience preparing incident reports, documenting investigation findings, and tracking remediation activities.
• Understanding of evidence preservation, incident timelines, and root cause analysis.

Candidates with limited professional experience may also be considered if they demonstrate strong technical fundamentals, relevant training, cybersecurity lab experience, internships, or practical projects.

Experience in a Security Operations Center (SOC), managed security services environment, enterprise IT department, or incident response team would be an advantage.

5. Working Hours

Employment Type: Full-time.

Typical Schedule: Approximately 40 hours per week, subject to local employment requirements and organizational policy.

Shift Requirements: Rotational shifts, evening or night shifts, weekends, or public holidays may be required for organizations operating continuous security monitoring.

Incident Escalations: Occasional availability outside regular working hours may be necessary during critical security incidents, depending on the agreed role and on‑call arrangements.

Work Location: On‑site, hybrid, or remote arrangements may be available depending on operational requirements, access permissions, and company policy.

Flexibility: Employees are expected to participate in scheduled incident reviews, team meetings, training sessions, and handover activities.

Working schedules, overtime arrangements, and on‑call responsibilities will be communicated during the recruitment process.

6. Knowledge, Skills, and Abilities

Technical Knowledge

Understanding of cybersecurity operations, security event monitoring, and incident response lifecycle management.

Knowledge of security logs, endpoint telemetry, network events, authentication records, and application security alerts.

Familiarity with SIEM, EDR, firewalls, intrusion detection systems, and threat intelligence platforms.

Understanding of identity and access management, multi‑factor authentication, privileged accounts, and access control principles.

Awareness of common attack patterns, adversary tactics, techniques, and procedures.

Knowledge of data protection principles, security policies, and incident reporting requirements.

Basic understanding of scripting or automation using Python, PowerShell, Bash, or similar tools is beneficial.

Analytical Skills

Ability to distinguish legitimate system activity from suspicious or potentially malicious behavior.

Capability to correlate evidence from different security tools and establish a clear incident timeline.

Ability to assess incident severity, potential impact, and business risk.

Strong problem‑solving skills and a structured approach to technical investigations.

Ability to identify patterns, recognize anomalies, and recommend practical security improvements.

Communication and Collaboration

Ability to explain technical findings clearly to technical teams, management, and other stakeholders.

Strong documentation skills, including the preparation of incident summaries and investigation reports.

Willingness to collaborate with cross‑functional teams during investigations and recovery activities.

Ability to elevate critical issues promptly and provide accurate status updates.

Professional Abilities

Ability to remain calm, organized, and focused during high‑priority security incidents.

Commitment to confidentiality, professional integrity, and appropriate evidence handling.

Ability to learn new security tools, investigate emerging threats, and adapt to evolving technologies.

Strong organizational skills and the ability to manage multiple investigations.

A proactive mindset focused on reducing security risks and preventing repeat incidents.

7. Benefits

The Elite Job aims to provide a supportive professional environment that encourages employee development, performance, and long‑term career growth. Benefits and eligibility will depend on the employment arrangement, work location, and applicable company policies.

Potential benefits may include:

• Competitive compensation based on experience, technical expertise, and role requirements.
• Opportunities for professional development through cybersecurity training and practical learning.
• Support for relevant industry certifications, subject to company policy.
• Access to security tools, technical resources, and structured investigation procedures.
• Opportunities to collaborate with experienced cybersecurity and IT professionals.
• Exposure to security operations, threat detection, incident management, and digital investigation practices.
• Career development opportunities within cybersecurity and information security functions.
• Flexible work arrangements where operational requirements permit.
• Paid leave and applicable statutory benefits in accordance with local employment policies.
• Performance feedback, mentoring, and opportunities to expand technical responsibilities.
• Participation in knowledge‑sharing sessions, incident reviews, and continuous improvement initiatives.
• Specific salary ranges, insurance coverage, bonuses, equipment provisions, and other benefits should be confirmed in the official employment offer.

8. Why Join The Elite Job?

Joining The Elite Job as an Incident Response Analyst offers an opportunity to contribute to cybersecurity operations and help protect important digital assets against evolving threats.

In this role, you will have the opportunity to apply analytical thinking, investigate security incidents, and collaborate with technical professionals to improve detection and response capabilities. Your work will help organizations understand security risks, reduce the impact of cyberattacks, and strengthen their incident management practices.

Reasons to consider this opportunity include:

• Meaningful Cybersecurity Work: Contribute to identifying and investigating security threats that could affect systems, data, and business operations.
• Practical Technical Development: Build experience in security event analysis, incident handling, threat investigation, and remediation coordination.
• Continuous Learning: Develop your knowledge of cybersecurity technologies, attacker techniques, and emerging threats.
• Collaborative Environment: Work with professionals across IT, security operations, infrastructure, and compliance functions.
• Career Progression: Develop a foundation for potential future roles such as Senior Incident Response Analyst, SOC Analyst, Threat Hunter, Digital Forensics Analyst, or Incident Response Engineer.
• Problem‑Solving Opportunities: Investigate complex technical issues, analyze evidence, and contribute to effective security solutions.
• Professional Growth: Strengthen your technical, communication, and decision‑making skills through practical responsibilities and ongoing learning.

The Elite Job values analytical thinking, accountability, collaboration, and a commitment to protecting information. We welcome candidates who are eager to contribute to security operations and develop their expertise in incident response.