Lead Cyber Incident Commander & Forensics Expert

UKG (Ultimate Kronos Group); Dover (DE); On-site; USD 146,000 - 209,000; Full time

Job summary

UKG is seeking a Senior Staff Security Analyst - Incident Commander to lead complex security incidents within the Global Security Operations team. You will coordinate technical response, guide investigations, and drive containment and recovery across endpoints, cloud, and networks.

The role requires 5+ years of hands-on DFIR in enterprise environments, strong scripting skills, and cloud security expertise. You will mentor analysts and develop incident playbooks, reports, and durable detections.

Qualifications

• Lead complex security incidents and guide technical teams.
• 5+ years hands-on DFIR in major enterprise environments.
• Advanced knowledge of forensic artifacts across network, cloud, Windows, Linux, endpoint, identity, and runtime environments.
• Experience coordinating incident command, tracking actions, and providing executive updates.
• Hands-on endpoint disk/memory/cloud host-based forensic analysis in active IR.
• Threat hunting with SIEM/EDR/cloud telemetry/identity logs.

Responsibilities

• Lead major cyber incident command activities with coordination and containment.
• Perform hands-on threat hunting across SIEM, EDR, cloud, and network data sources.
• Mentor analysts during incidents, tabletop exercises, and proactive hunts.
• Develop incident strategies, plans, and executive-facing summaries.
• Create training materials and playbooks for incident command and digital forensics.
• Advance detections by translating investigations into detection logic and hunting hypotheses.
• Assist reverse engineering or malware triage when needed.
• Collaborate across SOC, Threat Intelligence, Detection Engineering, and Legal/Privacy.
• Support continuous improvement of incident handling and forensic methods.
• Apply GenAI-assisted workflows while maintaining technical validation.

Skills

Incident response leadership

Forensic analysis

Threat hunting

GenAI-assisted workflows

Scripting (Python/PowerShell/Bash)

SOC operations

Mentoring/training analysts

Technical coordination

Cloud security

Reverse engineering

Tools

SIEM

EDR

SOAR

Cloud security tooling

Job description

UKG is seeking a Senior Staff Security Analyst - Incident Commander to lead complex security incidents within the Global Security Operations team. You will coordinate technical response, guide investigations, and drive containment and recovery across endpoints, cloud, and networks.

The role requires 5+ years of hands-on DFIR in enterprise environments, strong scripting skills, and cloud security expertise. You will mentor analysts and develop incident playbooks, reports, and durable detections.