Incident Response Lead, Cyber Security

Alignerr Corp.; Seattle (WA); Remote; USD 110,000 - 193,000; Part time

Job summary

Alignerr Corp. is seeking a seasoned Incident Response Lead for a fully remote, hourly contract engagement. If you’ve led real incidents, built response processes, or hunted for gaps, this role offers meaningful work across diverse SOC environments.

You will independently evaluate SOC operations, review detection workflows, stress-test playbooks, and surface gaps that keep security teams up at night. Remote, flexible commitment is available.

Qualifications

• Hands-on experience in SOC operations, incident response leadership, or cybersecurity operations.
• Strong ability to translate findings into structured written assessments.
• Independent, reliable delivery of high-quality evaluations.

Responsibilities

• Evaluate detection alert pipelines, triage workflows, and escalation pathways for quality and consistency
• Assess the completeness and effectiveness of incident response actions across real or simulated timelines
• Identify critical gaps in logging coverage, detection logic, and containment procedures
• Review and validate incident response playbooks for clarity, accuracy, and operational feasibility
• Summarize recurring incident patterns and pinpoint operational bottlenecks
• Support ongoing assessments of SOC maturity and overall response readiness
• Deliver structured, analytical documentation that drives actionable improvements

Skills

SOC operations

Incident response leadership

Cybersecurity operations

Tools

Splunk

Microsoft Sentinel

Chronicle

Job description

About The Role

What if your hard-won experience in the SOC trenches could directly strengthen how organizations detect, respond to, and contain real threats? We're looking for a seasoned Incident Response Lead to independently evaluate SOC operations — reviewing detection workflows, stress-testing playbooks, and surfacing the gaps that keep security teams up at night.

This is a fully remote, flexible contract engagement. If you've lived through real incidents, built response processes from scratch, or spent time hunting for what others missed — this is work that will feel both familiar and meaningful.

• Type: Hourly Contract


• Location: Remote


• Commitment: Flexible

What You'll Do

• Evaluate detection alert pipelines, triage workflows, and escalation pathways for quality and consistency


• Assess the completeness and effectiveness of incident response actions across real or simulated timelines


• Identify critical gaps in logging coverage, detection logic, and containment procedures


• Review and validate incident response playbooks for clarity, accuracy, and operational feasibility


• Summarize recurring incident patterns and pinpoint operational bottlenecks


• Support ongoing assessments of SOC maturity and overall response readiness


• Deliver structured, analytical documentation that drives actionable improvements

Who You Are

• Hands-on experience in SOC operations, incident response leadership, or cybersecurity operations


• Strong working knowledge of detection engineering, response workflows, and incident lifecycle management


• Sharp analytical thinking with the ability to translate findings into clear, structured written assessments


• Comfortable working independently and delivering consistent, high-quality evaluations

Nice To Have

• Familiarity with SIEM platforms (e.g., Splunk, Sentinel, Chronicle)


• Experience with EDR tools and cloud-native detection systems


• Background in threat intelligence, purple teaming, or adversary simulation


• Relevant certifications such as GCIH, GCFA, CISSP, or equivalent

Why Join Us

• Apply deep security expertise to work that has a real, measurable impact on organizational resilience


• Fully remote and flexible — complete assessments on a schedule that works for you


• Freelance autonomy with meaningful, structured task-based work


• Engage with a diverse range of SOC environments, toolsets, and operational challenges


• Potential for ongoing work and contract extension across new assessments and engagements