Remote Principal Incident Response & Forensics Lead

Blackbaud; Charleston (SC); On-site; USD 102,000 - 133,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

Remote-flexible workforce

Wellness Programs

401(k) with employer match

Flexible paid time off

Parental Leave

Donations for Doers

Pet insurance, identity protection

Tuition reimbursement program

Job summary

Blackbaud is seeking a Principal Incident Response Analyst for the Threat Detection & Response team to lead in-depth security event analysis, rapid incident containment, and forensic investigations. You will drive threat hunting, coordinate with cross-functional teams, and leverage threat intelligence to strengthen detection capabilities across the organization.

The role requires extensive experience in incident response, digital forensics, and familiarity with industry frameworks.

Qualifications

• 8+ years of cyber incident response experience in a large and complex environment.
• Certifications such as CISSP, GCIH, GFCA, GREM, ECIH are highly desirable.
• Subject matter expertise with security tools and technologies, such as SIEM, IDS/IPS, EDR, and network monitoring solutions.
• Strong knowledge of incident response methodologies, including containment, eradication, recovery, and common frameworks (NIST, SANS, CSA).
• Ability to acquire and analyze endpoint and network artifacts, volatile memory, malicious files/binaries and scripts.
• Experience with forensic tools such as Encase, FTK, Axiom, and Cellebrite for digital investigations.
• Collaborate with forensic analysts, law enforcement, and legal experts to preserve evidence and prevent spoliation.

Responsibilities

• Conduct in-depth analysis of security events and indicators to determine the nature and severity of incidents.
• Respond promptly to security incidents, following established incident response procedures.
• Coordinate and collaborate with cross-functional teams to contain and mitigate threats effectively.
• Perform forensic investigations to determine the root cause and develop remediation strategies.
• Lead regular threat hunt activities to identify and investigate gaps in detection.
• Utilize threat intelligence and best practices to enhance incident detection capabilities.

Skills

Cyber incident response

Threat hunting

Cyber forensics

Security monitoring

Incident response frameworks

Tools

SIEM

IDS/IPS

EDR

Network monitoring

Job description

Blackbaud is seeking a Principal Incident Response Analyst for the Threat Detection & Response team to lead in-depth security event analysis, rapid incident containment, and forensic investigations. You will drive threat hunting, coordinate with cross-functional teams, and leverage threat intelligence to strengthen detection capabilities across the organization.

The role requires extensive experience in incident response, digital forensics, and familiarity with industry frameworks.