Incident Response Lead - Blue Team & Automation

Atlas Search; New York (NY); On-site; USD 140,000 - 190,000; Full time

Job summary

Atlas Search is seeking a hands-on Blue Team / Incident Response Lead to join a growing cybersecurity team supporting a large-scale enterprise environment. This role centers on leading high‑severity incidents from investigation through containment and remediation.

You will develop and refine incident response playbooks, tabletop exercises, and operational readiness, while partnering with security engineering to enhance SOAR automation and AI‑assisted response workflows.

Qualifications

• 6+ years of Incident Response, Blue Team, or Security Operations experience.
• Experience as incident lead or escalation point for complex security events.
• Knowledge of cloud security, identity-based threats, MITRE ATT&CK, and hybrid environments.

Responsibilities

• Lead high‑severity security incidents from investigation through containment and remediation.
• Conduct investigations across cloud, identity, endpoint, network, SaaS, and hybrid environments.
• Develop and improve incident response playbooks, tabletop exercises, and operational readiness.
• Partner with security engineering teams to enhance SOAR automation, AI‑assisted response workflows, and security operations.
• Collaborate with infrastructure, cloud, and identity teams to strengthen enterprise security and response capabilities.
• Drive continuous improvement through post‑incident reviews, metrics, and threat‑informed security enhancements.

Skills

Incident Response

Blue Team

Security Operations

Cloud security

MITRE ATT&CK

SOAR

AI-enabled security operations

Job description

Atlas Search is seeking a hands-on Blue Team / Incident Response Lead to join a growing cybersecurity team supporting a large-scale enterprise environment. This role centers on leading high‑severity incidents from investigation through containment and remediation.

You will develop and refine incident response playbooks, tabletop exercises, and operational readiness, while partnering with security engineering to enhance SOAR automation and AI‑assisted response workflows.