Remote Incident Response & DFIR Lead - FinTech Security

Greenhouse Software, Inc.; United States; Remote; USD 120,000 - 160,000; Full time

Benefits offered by this job

Vacation days

Sick leave

Public holidays

Medical budget

Remote work

Education budget

Language budget

Wellness budget

Job summary

Greenhouse Software, Inc. is seeking an Incident Response & DFIR Lead to spearhead incident response, containment and forensic activities across endpoints, cloud and identity systems.

You will act as Incident Commander for major incidents, coordinate cross-team investigations, and drive evidence collection and post-incident reviews to strengthen security posture. Ideal candidates bring hands-on IR lifecycle experience, SIEM/XDR proficiency, and strong communication to leadership and technical

Qualifications

• Experience leading complex security incidents with multi-team coordination.
• Practical experience in endpoint/server/cloud investigations using SIEM/audit logs.
• Familiarity with incident lifecycle and evidence handling.

Responsibilities

• Lead incident response, containment and forensic coordination for confirmed security incidents.
• Act as Incident Commander for major security incidents within the defined authority model.
• Assign incident roles and maintain ownership of investigation, containment and recovery actions.
• Maintain incident timelines, evidence logs, decision logs and action tracking.
• Coordinate investigation across endpoints, servers, identities, cloud platforms, SaaS environments and relevant network telemetry.
• Direct forensic collection and analysis to determine attack path, scope, persistence and impact.
• Coordinate containment actions with IAM, Platform, IT, Security Engineering, Product and other technical owners.
• Recommend high-impact containment decisions to the Group Manager of Cyber Defense and CISO where required.
• Coordinate eradication and recovery actions and ensure systems return to a sufficiently trusted state.
• Ensure relevant evidence is preserved for Legal, HR, regulatory, disciplinary and post-incident requirements.
• Maintain practical forensic and evidence-handling standards.
• Develop and maintain incident playbooks, forensic checklists and containment procedures.
• Lead post-incident reviews and root-cause analysis.
• Ensure post-incident remediation actions have accountable owners, due dates and follow-up.
• Identify telemetry, detection and forensic-readiness gaps exposed during investigations.
• Convert investigation findings into recommendations for Detection Engineering, IAM, Security Engineering, Product Security and other control owners.
• Support incident exercises and readiness testing.
• Develop and mentor Incident Response / DFIR Specialists.
• Coordinate with external forensic, incident-response or specialist providers where required.
• Provide concise incident updates to Cyber Defense leadership, CISO and relevant stakeholders.

Skills

Incident response

Incident Commander

Forensics

EDR/XDR

Cloud forensics

Windows/Linux

Documentation

Scripting

Tools

Velociraptor

KAPE

Volatility

EnCase

FTK

Cortex XDR

Job description

Greenhouse Software, Inc. is seeking an Incident Response & DFIR Lead to spearhead incident response, containment and forensic activities across endpoints, cloud and identity systems.

You will act as Incident Commander for major incidents, coordinate cross-team investigations, and drive evidence collection and post-incident reviews to strengthen security posture. Ideal candidates bring hands-on IR lifecycle experience, SIEM/XDR proficiency, and strong communication to leadership and technical