Lead, Cyber Incident Response

Sony Pictures Entertainment, Inc; Culver City (CA); On-site; USD 142,000 - 178,000; Full time

Benefits offered by this job

Annual incentive

Comprehensive benefits

Job summary

Sony Pictures Entertainment is seeking an experienced Lead Cyber Incident Response professional to lead complex investigations across SPE's corporate, cloud, identity, and production environments. You will serve as a senior technical resource within the Incident Response team and collaborate with Legal, Privacy, and business stakeholders.

Responsibilities include incident commander duties, playbook development, mentoring analysts, and driving improvements in detection, containment, and recovery.

Qualifications

• 8+ years of cybersecurity experience with focus on incident response, forensics, threat hunting, or security operations.
• Proven experience leading enterprise-scale investigations and incident response efforts.
• Strong knowledge of modern attack techniques, threat actor behavior, and investigative methodologies.

Responsibilities

• Lead complex cybersecurity investigations from detection through containment, eradication, and recovery.
• Serve as incident commander, coordinating technical responders and business stakeholders.
• Investigate ransomware, phishing, insider threats, data exposure, and cloud security incidents.
• Develop and improve incident response playbooks and runbooks.
• Mentor analysts and provide executive-ready updates and risk-informed recommendations.

Skills

Incident response

Digital forensics

Threat hunting

Security operations

Executive communication

Stakeholder management

Education

CISSP

GCIH

GCFA

GCIA

GNFA

Tools

SIEM

SOAR

EDR/XDR

Cloud security

Azure

AWS

Microsoft 365

Python

PowerShell

Job description

Sony Pictures Entertainment (SPE) is seeking an experienced Lead Cyber Incident Response professional to help protect the company's people, intellectual property, productions, technology platforms, and business operations from cyber threats. This role leads complex cybersecurity investigations, coordinates response activities during significant security incidents, and advances SPE's incident response capabilities. The successful candidate will serve as a senior technical resource within the Incident Response team, leading investigations across corporate, cloud, identity, SaaS, and production environments while partnering with Security Operations, Threat Intelligence, Engineering, Legal, Privacy, People & Organization (P&O), Corporate Communications, and business stakeholders.

Key Responsibilities

Incident Response and Investigations

• Lead complex cybersecurity investigations from initial detection through containment, eradication, recovery, and post-incident review.
• Serve as incident commander for assigned incidents, coordinating technical responders and business stakeholders throughout the response lifecycle.
• Investigate ransomware, identity compromise, phishing, insider threats, data exposure, cloud security incidents, and other advanced cyber threats.
• Conduct digital forensic investigations to determine root cause, scope, business impact, and remediation requirements.

Business and Asset Protection

• Investigate threats affecting SPE intellectual property, content, productions, employees, technology platforms, third-party partners, and business operations.
• Assess cyber events from both technical and business-risk perspectives, balancing risk reduction with operational continuity.
• Partner with Legal, Privacy, People & Organization (P&O), Corporate Communications, and business leadership on sensitive investigations and response activities.

Security Operations and Continuous Improvement

• Collaborate with Security Operations, Threat Intelligence, Detection Engineering, and Security Engineering to enhance detection and response capabilities.
• Develop and improve incident response playbooks, runbooks, escalation procedures, investigative methodologies, and operational standards.
• Drive automation and workflow optimization through SOAR, scripting, AI-enabled capabilities, and emerging technologies.
• Lead post-incident reviews and translate lessons learned into measurable security and operational improvements.

Technical Leadership

• Serve as a senior escalation point for complex investigations and high-severity incidents.
• Mentor Incident Response analysts through case reviews, training, coaching, and knowledge sharing.
• Provide clear technical updates, executive-ready summaries, after-action reports, and risk-informed recommendations.
• Contribute to strategic initiatives that strengthen SPE cyber resilience and operational maturity.

Qualifications

Required

• 8+ years of cybersecurity experience, with significant focus on incident response, digital forensics, threat hunting, or security operations.
• Proven experience leading enterprise-scale cybersecurity investigations and incident response efforts.
• Strong knowledge of modern attack techniques, threat actor behavior, digital forensics, and investigative methodologies.
• Experience with cloud security, identity security, endpoint detection and response (EDR/XDR), SIEM, and SOAR platforms.
• Excellent analytical, communication, and stakeholder-management skills, including the ability to explain complex technical issues to executive and non-technical audiences.

Preferred

• Experience supporting global media, entertainment, technology, or other highly distributed enterprise environments.
• Experience investigating incidents involving intellectual property, insider threats, data exposure, or third-party compromise.
• Experience with Microsoft 365, Azure, AWS, modern SaaS environments, and identity platforms.
• Knowledge of Python, PowerShell, or other scripting and automation technologies.
• Relevant industry certifications such as CISSP, GCIH, GCFA, GCIA, GNFA, or equivalent.

The anticipated base salary for this position is $142,400 - $178,000. This role may also qualify for annual incentive and/or comprehensive benefits. The actual base salary offered will depend on a variety of factors, including without limitation, the qualifications of the individual applicant for the position, years of relevant experience, level of education attained, certifications or other professional licenses held, and if applicable, the location of the position.

Sony Pictures Entertainment is an equal opportunity employer. We evaluate qualified applicants without regard to race, color, religion, sex, national origin, disability, veteran status, age, sexual orientation, gender identity, or other protected characteristics. SPE will consider qualified applicants with arrest or conviction records in accordance with applicable law.

Sony Pictures does not allow audio recording, video recording or use of AI note-taking tools during interviews. Please be aware these tools may be enabled as a default and can be difficult to disable once the interview has started, so we recommend you check your device and disable these tools prior to the start of your interview. If recording or the use of the tools occurs during the interview and cannot be promptly turned off or disabled, the interviewer may end the interview.

To request an accommodation for purposes of participating in the hiring process, you may contact us at [e-mail].

Hi, we’re Sony Pictures Entertainment We are in the business of creativity … making some of the most beloved film and television of all time for every platform in the world. As the most creative and proudly independent studio, our future is boundless. Sony Pictures Entertainment is a division of Sony Corporation, a creative entertainment company built on a foundation of technology. Along with our sister companies, we make movies, television, music and games that engage billions of people, connecting creators and audiences around the globe. We are looking for innovators to join us as we forge the future of entertainment! Don't see a job opportunity that matches your interests, skills or experiences?