Mid-level Incident Response Consultant

Cypress HCM; United States; On-site; USD 83,000 - 124,000; Full time

Job summary

Cypress HCM is seeking two incident responders for an immediate, hands‑on contract role in the United States. You will pick up an active caseload, investigate indicators of compromise, read alerts, and connect information to prevent bigger incidents.

You will triage alerts, conduct end‑to‑end investigations, document findings for handoff or audit, and participate in on‑call rotations. 3–5 years of relevant experience is required.

Qualifications

• 3–5 years in incident response or SOC operations.
• Experience with SIEM/EDR tools and log analysis.
• Ability to manage caseload with minimal ramp-up.

Responsibilities

• Triage alerts and run investigations from initial detection through containment.
• Work assigned incidents end to end, escalating to the technical lead when severity or scope changes.
• Document findings and timelines clearly enough for handoff or audit.
• Participate in on‑call rotation.

Skills

Incident response

SOC analyst

Security operations

Independent work

Tools

SIEM

EDR

Log analysis

Job description

Engagement: contract, immediate start, initial 6 to 12 months, likely to extend.

Reports to: Sr. Director, Security Operations Center, with day to day direction from the SOC technical lead or the Sr. Director.

We need two incident responders to pick up active caseload right away. This is hands‑on investigative work. We need people who can start working cases within the first week, comfortable with understanding indicators of compromise, reading alerts, and connecting information that may lead to preventing a bigger incident.

Responsibilities

• Triage alerts and run investigations from initial detection through containment.
• Work assigned incidents end to end, escalating to the technical lead when severity or scope changes.
• Document findings and timelines clearly enough for handoff or audit.
• Participate in on‑call rotation.

Requirements

• 3 to 5 years in incident response, SOC analyst, or similar hands‑on security operations work.
• Working knowledge of SIEM and EDR tools, log analysis, and common attack patterns.
• Able to work independently on a caseload from day one with minimal ramp time.