Lead Incident Response Analyst

Transocean Ltd; Houston (TX); Sur place; USD 140 000 - 180 000; Plein temps

Résumé du poste

Transocean Ltd in Houston seeks an experienced Lead Cyber Security Incident Response Team (CSIRT) lead to spearhead major investigations across enterprise and OT environments. You will act as incident commander, coordinate with Security Operations, Infrastructure, Identity & Application teams, and provide expert guidance on threats, incident response processes, and threat intelligence.

You will develop playbooks, runbooks, and detection methods; mentor junior analysts and MSSP partners;

Qualifications

• Minimum required bachelor's degree and at least one security certification such as Security+.
• Preferred: additional certifications from the list (GCIH, GCFA, CISSP, CISM) or equivalent.
• Minimum 3 years in incident response or security operations; 7+ years preferred leading SOC.

Responsabilités

• Lead and coordinate cybersecurity incident investigations, including triage, analysis, validation, containment, eradication, recovery and closure.
• Serve as the primary incident commander with management during major security events and coordinate across teams.
• Develop, maintain, and improve incident response procedures, playbooks, runbooks and detection methodologies.
• Lead post-incident reviews and root cause analyses, recommending corrective actions.
• Communicate incident status, risks, and remediation to technical teams, management and executives.

Formation

Bachelor's degree in Information Technology or Cybersecurity Related Experience

Security+

GCIH

GCFA

CISSP

CISM

Description du poste

Information Technology Group Transocean is focused on being the employer of choice for the drilling industry. We are challenging ourselves every day to push the performance of the company through technological advances and passion for our work.

Job Summary

Serves as the dedicated lead responder for Transocean's Cyber Security Incident Response Team (CSIRT), responsible for leading major investigation, coordination, containment, eradication, recovery, and post-incident analysis of cybersecurity incidents across enterprise and operational technology environments. Acts as the primary point of contact for cybersecurity incident response activities, coordinating with internal stakeholders, managed security providers, technology teams, and third-party vendors. Provides expert guidance on cyber threats, incident response processes, threat intelligence, and continuous improvement of the organization's security operations and incident management capabilities.

Job Description

Key Roles & Responsibilities

• Lead and coordinate cybersecurity incident investigations, including triage, analysis, validation, containment, eradication, recovery, and closure of security incidents.
• Serve as the primary incident commander working closely with management during major security events, coordinating activities between Security Operations, Infrastructure, Identity & Application teams.
• Develop, maintain, and improve incident response procedures, playbooks, runbooks, escalation processes, and detection methodologies.
• Lead post-incident reviews, root cause analysis activities, lessons learned sessions and recommend corrective actions to prevent recurrence.
• Communicate incident status, risks, and remediation activities to technical teams, management, executives, and external stakeholders.
• Provide mentoring and guidance to junior analysts, MSSP personnel, and incident response stakeholders regarding incident handling procedures and cyber threats.
• Produce incident metrics, reports, KPI dashboards, and executive summaries that measure CSIRT effectiveness and operational maturity.
• Lead continuous improvement initiatives across security monitoring and incident response functions by collaborating with Security Engineering teams to enhance detection coverage, automate response activities, improve security analytics, and drive operational metrics such as mean time to detect (MTTD), mean time to respond (MTTR), and overall incident response effectiveness.

Education

• Minimum Required - Bachelor's degree in Information Technology or Cybersecurity Related Experience, one or more security certifications such as Security+
• Preferred - Bachelor's degree in Information Technology or Cybersecurity Related Experience, one or more security certifications such as Security +, GCIH, GCFA, CISSP, CISM or equivalent

Experience

• Minimum Required - 3 years focused on incident response, threat hunting, security operations or cyber investigations
• Preferred - 7+ years of cybersecurity experience leading Security Operations Center (SOC)

If you want to push yourself to great achievement, let Transocean develop your career. There is a pioneering spirit at Transocean. The ocean is our frontier. We venture across the seas and explore new depths, using advanced technology to find and develop hydrocarbon reserves. Transocean is a leading international provider of offshore contract drilling services for oil and gas wells. The company specializes in technically demanding sectors of the global offshore drilling business, with a particular focus on ultra-deepwater and harsh environment drilling services and operates the highest specification floating offshore drilling fleet in the world. Transocean owns or has partial ownership interests in and operates a fleet of 27 mobile offshore drilling units, consisting of 20 ultra-deepwater floaters and seven harsh environment floaters.