Incident Response Lead

AspenView Technology Partners, Inc.; United States; Hybrid; USD 130,000 - 180,000; Full time

Benefits offered by this job

Flexible work model

Competitive base

Real growth opportunities

Inclusive culture

Job summary

AspenView Technology Partners, Inc. is seeking an experienced Incident Response Lead to guide major security incidents for a large US consumer lender.

This senior, hands-on role leads DFIR, triage, and containment across Windows, Linux, and cloud environments, coordinating with a nearshore team in Latin America and reporting to the SOC/Cyber Operations Lead. The candidate will own incident playbooks, runbooks, tabletop exercises, and oversee two Tier-3 analysts—travel to client sites and Bogotá,

Qualifications

• Senior level with hands-on DFIR experience in large environments.
• Ability to lead major incidents end-to-end across teams.
• Strong communication for executives, legal and auditors.
• Experience with nearshore/offshore teams is a plus.

Responsibilities

• Serve as incident lead on the major-incident bridge and coordinate with clients and analysts.
• Define containment actions and provide evidence-backed guidance for infrastructure and identity teams.
• Prepare operational updates and executive summaries during incidents and post-incident reviews.
• Own the DFIR work inside the service, including host/memory triage and cloud investigations.
• Investigate Okta sessions, AWS activity, and build investigation records for regulatory notifications.

Skills

Senior

Incident response

Forensics

Leadership

Cloud forensics

Tools

Elastic

Abstract Security

ServiceNow SecOps

CrowdStrike Falcon

Microsoft Defender

Okta/Entra ID

AWS CloudTrail

Job description

At AspenView, we’re more than a nearshore IT partner—we’re a people-first, purpose-driven company that believes great culture drives great outcomes. We’re passionate about connecting talent and technology to deliver measurable value for clients—and meaningful career paths for our people.

Here’s what you can expect:

• Competitive base
• Flexible work model: hybrid, remote, or in-office
• Real growth opportunities and leadership visibility
• Inclusive, respectful culture that blends U.S. innovation with Colombian heart
• A company that listens, invests in you, and celebrates wins together

The Incident Response Lead is a senior, hands‑on professional responsible for leading incident response and the embedded digital forensics capability for a large US consumer lender. The client's 24/7 security operations run from a nearshore team in Bogotá, Medellin and Buenos Aires, and you will be one of two US‑based seniors on the service, highly visible to the client's security leadership. When the client declares a major incident, you will be the incident lead on its bridge. The client declares incidents and executes containment; your job is to tell it what happened, how far it reached and what to contain, with the evidence to back it. You will report to the SOC / Cyber Operations Lead and provide technical direction to two Tier 3 analysts in Latin America.

What you will do:

Major Incident Leadership

• Serve as incident lead on the client's major‑incident bridge, working alongside its incident commander and keeping the client, the partner and the analysts aligned on one version of events.
• Scope incidents and deliver evidence‑backed containment recommendations for the client's infrastructure, identity, endpoint and application teams to execute.
• Write operational updates for responders and executive summaries for client leadership during incidents, and lead the post‑incident review afterwards.
• Own the DFIR work inside the service, including host and memory triage and analysis of CrowdStrike and Defender endpoint telemetry.
• Investigate Okta sessions and tokens, and AWS activity through CloudTrail, GuardDuty and VPC flow logs.
• Build investigation records and timelines that give the client what it needs for its own regulatory notification decisions under NYDFS Part 500 and GLBA.

Readiness & Team Direction

• Develop IR playbooks and runbooks, including a review of the client's existing content.
• Run tabletop exercises with the client's security, legal and risk teams.
• Guide two Tier 3 analysts in Latin America who act as your first line on overnight investigations.

Tools & Technologies:

• SIEM & Case Management: Elastic, Abstract Security and ServiceNow SecOps (Splunk or Sentinel also relevant).
• Endpoint & Identity: CrowdStrike Falcon, Microsoft Defender and Okta (or Entra ID).
• Cloud: AWS CloudTrail, GuardDuty and VPC flow logs (Azure or GCP accepted).
• Email & Network (Bonus): Proofpoint and Palo Alto, or equivalents.
• Forensics (Bonus): Velociraptor, KAPE, Volatility, FTK, EnCase or X‑Ways.

What you bring:

• Experience: Senior enough to lead the technical response to a major incident, and able to walk through one end to end, including what went wrong and what you changed afterwards. Hands‑on forensics on Windows and Linux hosts and investigations in at least one major cloud.
• Technical Independence: You query SIEM, EDR and identity logs directly rather than waiting for an analyst to pull the data.
• Judgment: The ability to recommend containment that stops an attacker without taking down a lending platform at month end.
• Communication / Leadership: Incident reports that a CISO, a lawyer and an examiner can each read without a translator. Proven ability to lead people you don't line‑manage, including analysts in another country.
• Availability: Remote work from the United States on US Eastern business hours, plus a 24/7 on‑call rotation and periodic travel to the client and to Bogotá, Medellin or Buenos Aires. US work authorization is required, and access requires identity, criminal background, employment and education checks, repeated periodically.
• Bonus Qualifications: Incident response inside a bank, lender, card issuer or insurer; working knowledge of NYDFS Part 500, GLBA, FFIEC, SOX and PCI DSS incident obligations; experience with ransomware, business email compromise or fraud‑driven intrusions in consumer finance; consultancy or MSSP background; GCIH, GCFA, GCFE, GREM or CISSP; and Spanish, which helps with the nearshore team but isn't required.