Remote IR Lead: Cloud Security & Incident Response

FICO; United States; Remote; USD 137,000 - 215,000; Full time

Benefits offered by this job

Remote-work option

Job summary

FICO is seeking a Senior/Lead Incident Response Engineer to lead defensive security operations, owning detection, containment, and recovery from incidents. You will design tabletop exercises, drive cross‑team readiness, and strengthen IR capabilities with threat intel, SOC, and engineering collaboration.

The role emphasizes cross‑functional leadership, forensics support, and cloud security expertise, including AI/automation integration in IR workflows. Remote options are available.

Qualifications

• Experience designing and facilitating IR tabletop exercises across cross‑functional teams.
• Ability to drive improvements from IR findings and exercise results.
• Familiarity with forensics tools and cloud security fundamentals.

Responsibilities

• Design and facilitate incident response tabletop exercises across security, IT, engineering, legal, and business teams, testing preparedness and surfacing gaps.
• Own the full incident lifecycle: detection, triage, containment, eradication, recovery, and post‑incident review.
• Build and maintain IR plans, playbooks, and runbooks for consistent response.

Skills

IR tabletop exercises

IR lifecycle

communication

incident response

Tools

Magnet Axiom

Velociraptor

Volatility

FTK

Autopsy

AWS Cloud security

Job description

FICO is seeking a Senior/Lead Incident Response Engineer to lead defensive security operations, owning detection, containment, and recovery from incidents. You will design tabletop exercises, drive cross‑team readiness, and strengthen IR capabilities with threat intel, SOC, and engineering collaboration.

The role emphasizes cross‑functional leadership, forensics support, and cloud security expertise, including AI/automation integration in IR workflows. Remote options are available.