Principal Incident Response Consultant

Cypress HCM; United States; On-site; USD 140,000 - 180,000; Full time

Job summary

Cypress HCM is seeking a Principal Incident Response Consultant to serve as interim technical lead for our Security Operations Center. This contract role starts immediately for 6 to 12 months and may extend, reporting to the Sr. Director, Security Operations.

You will run point on major incidents, perform triage and escalation calls, mentor the IR team, and coordinate with Enterprise Security and Threat Intelligence to keep detection and response moving when leadership is unavailable.

Qualifications

• 7+ years in incident response or security operations, including time leading investigations.
• Comfortable owning decisions during live incidents without a direct manager present.
• Hands-on experience with SIEM, EDR, and case management tooling.

Responsibilities

• Act as technical lead and escalation point for the SOC during active incidents.
• Guide and mentor the incident response team through investigations, from triage to containment to root cause.
• Make severity and escalation calls independently when the SOC director is unavailable.
• Coordinate with Enterprise Security, Threat Intelligence, and other teams during multi-team incidents.
• Flag process or coverage shortfalls to leadership as they come up.

Skills

Incident response leadership

SIEM

EDR

Case management tooling

Job description

Principal Incident Response Consultant, that can help as a SOC Technical Lead

Engagement: contract, immediate start, initial 6 to 12 months, could be extended.

Reports to: Sr. Director, Security Operations Center.

We need an experienced incident response leader to serve as interim technical lead for our Security Operations Center. This person will run point on major incidents, make triage and escalation calls, and keep detection and response work moving if our SOC director is out on leave or otherwise engaged.

Responsibilities

• Act as technical lead and escalation point for the SOC during active incidents.
• Guide and mentor the incident response team through investigations, from triage to containment to root cause.
• Make severity and escalation calls independently when the SOC director is unavailable.
• Coordinate with Enterprise Security, Threat Intelligence, and other teams in the company during multi-team incidents.
• Flag process or coverage shortfalls to leadership as they come up.

Requirements

• 7+ years in incident response or security operations, including time leading investigations, not just executing them.
• Comfortable owning decisions during a live incident without a manager in the room.
• Hands-on experience with SIEM, EDR, and case management tooling.