Incident Response Lead — Automations, Playbooks & Forensics

General Motors LLC; Michigan; Hybride; USD 120 000 - 170 000; Plein temps

Avantages offerts par ce poste

Relocation benefits

Résumé du poste

General Motors LLC is seeking a Cyber Security Incident Handler to triage and investigate alerts, coordinate containment, and drive remediation across the enterprise. You will develop investigative plans, collect evidence, and use CrowdStrike, SIEMs, and live‑response tools to respond to incidents, with an emphasis on automation and repeatable workflows.

You will collaborate with Threat Intelligence, Endpoint, Engineering, and Security Operations teams, and contribute to playbooks, dashboards,

Qualifications

• Incident triage, investigation, containment, and recovery.
• Windows live‑response design and deployment.
• CrowdStrike administration and engineering across workflows and SIEMs.
• Automation and scripting for security operations.
• CI/CD and IaC for incident response tooling.

Responsabilités

• Triage and investigate security alerts and incidents across endpoints and networks.
• Develop investigative plans, gather evidence, and document findings.
• Coordinate containment, eradication, and remediation actions.
• Use CrowdStrike, Next‑Gen SIEM, and live‑response tooling to respond to incidents.
• Coordinate incident activities with multiple security and engineering teams.
• Create durable incident documentation including timelines and root cause.

Connaissances

Incident response

Investigation

CrowdStrike

Next-Gen SIEM

Python development

GitHub Actions

Terraform

CI/CD

Automation

MISP integration

Slack

Sguil

Confluence

Formation

Bachelor's degree in Cyber Security or related field

Outils

CrowdStrike Falcon

Velociraptor

YARA

GitHub

CI/CD tooling

Sguil

MISP

Description du poste

General Motors LLC is seeking a Cyber Security Incident Handler to triage and investigate alerts, coordinate containment, and drive remediation across the enterprise. You will develop investigative plans, collect evidence, and use CrowdStrike, SIEMs, and live‑response tools to respond to incidents, with an emphasis on automation and repeatable workflows.

You will collaborate with Threat Intelligence, Endpoint, Engineering, and Security Operations teams, and contribute to playbooks, dashboards,