Senior Cyber Incident Commander & IR Leader

UKG (Ultimate Kronos Group); Indianapolis (IN); On-site; USD 146,000 - 209,000; Full time

Job summary

UKG is seeking a Senior Staff Security Analyst - Incident Commander to join its Global Security Operations team in Indianapolis. You will lead major cybersecurity incidents, perform digital forensics, and drive containment and recovery across cloud, endpoint, and identity environments.

You will mentor analysts, develop playbooks, and implement GenAI-assisted workflows to accelerate investigations and standardize responses.

Qualifications

• Experience leading complex security incidents and guiding technical teams.
• 5+ years of hands-on digital forensics and incident response in large enterprises.
• Advanced knowledge of forensic artifacts across network, cloud, Windows, Linux, and endpoints.
• Experience coordinating major cyber incident command and post-incident improvements.
• Hands-on skills in endpoint disk/memory, cloud, and host-based forensics during active incidents.
• Threat hunting experience with SIEM/EDR/cloud telemetry and network data.

Responsibilities

• Lead complex security incidents and guide technical response activities.
• Coordinate technical workstreams, track actions, and brief stakeholders.
• Perform hands-on threat hunting across SIEM, EDR, cloud, and forensics data sources.
• Support and lead investigations as a technical contributor across SOC and related teams.
• Mentor analysts during incidents, tabletop exercises, and proactive hunting engagements.
• Develop incident strategies, plans, and technical summaries for leadership.

Skills

Digital forensics

Incident response

Threat hunting

GenAI workflows

Python/PowerShell/Bash

SOC operations

Executive reporting

Tools

SIEM

EDR

SOAR

Cloud security platforms

Forensic tooling

Case management

Job description

UKG is seeking a Senior Staff Security Analyst - Incident Commander to join its Global Security Operations team in Indianapolis. You will lead major cybersecurity incidents, perform digital forensics, and drive containment and recovery across cloud, endpoint, and identity environments.

You will mentor analysts, develop playbooks, and implement GenAI-assisted workflows to accelerate investigations and standardize responses.