Remote Lead Incident Response & Forensics

Merck & Co.; Rahway (NJ); On-site; USD 117,000 - 184,000; Full time

Job summary

Merck & Co. is seeking a Lead Incident Response Analyst to manage the day-to-day operations of the Cyber Fusion Center in the US Tech Center, Rahway, NJ. The role supports a 24x7x365 team and requires flexibility to respond to incidents outside core hours.

You will lead complex investigations across cloud and on-prem environments, coordinate across locations, and drive containment actions while mentoring staff and updating playbooks for improved response.

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity or equivalent work experience.
• 7+ years of hands-on experience in cybersecurity operations, incident response, or threat detection.
• Experience leading complex investigations involving cloud environments, identity systems, and modern endpoint tooling.
• Experience building or shaping a detection and response program in partnership with leadership.
• Strong familiarity with attacker TTPs (MITRE ATT&CK), log analysis, and correlation techniques.
• Practical experience with digital forensics fundamentals (artifact analysis, timeline creation, host/network investigation).
• Ability to interpret MDR escalations and independently drive deeper analysis and containment actions.

Responsibilities

• Incident Response & Investigation: conduct response for escalated MSSP/MDR alerts across cloud and endpoint environments; on-call for high-severity incidents.
• Perform forensic review of affected systems with log correlation and event reconstruction.
• Provide clear incident findings, timelines and remediation steps to technical and non-technical stakeholders.
• Coordinate incident response activities across teams or with partners.
• Lead the initial response for the Cyber Fusion Center for high impact cybersecurity events.
• Develop, mentor, and lead the teams and individual members; oversee day-to-day operations.

Skills

Incident Response

Forensic Analysis

Log Analysis

Threat Detection

Cloud Security

MDR/IR Leadership

Education

Bachelor's degree in CS/Cybersecurity

Tools

SIEM

EDR

CloudTrail

CloudWatch

WAF

Proxy

Job description

Merck & Co. is seeking a Lead Incident Response Analyst to manage the day-to-day operations of the Cyber Fusion Center in the US Tech Center, Rahway, NJ. The role supports a 24x7x365 team and requires flexibility to respond to incidents outside core hours.

You will lead complex investigations across cloud and on-prem environments, coordinate across locations, and drive containment actions while mentoring staff and updating playbooks for improved response.