Senior Cyber Incident Commander — Lead & Respond

UKG (Ultimate Kronos Group); Little Rock (AR); On-site; USD 146,000 - 209,000; Full time

Job summary

UKG is seeking a Senior Staff Security Analyst - Incident Commander to join the Global Security Operations team. You will lead complex security incidents, coordinate technical response, and drive containment and recovery across enterprise environments.

The role requires hands-on DFIR experience, expert forensic analysis across networks and endpoints, and the ability to mentor analysts during investigations and tabletop exercises.

Qualifications

• 5+ years of direct hands-on digital forensics and incident response experience in enterprise environments.
• Advanced knowledge of forensic artifacts across network, cloud, Windows, Linux, and endpoint environments.
• Experience leading major cyber incident command with coordination and post-incident improvements.
• Hands-on endpoint, memory, cloud, and host-based forensic analysis in incident scenarios.
• Threat hunting using SIEM, EDR, cloud telemetry, identity logs, and network data.
• Experience applying GenAI-assisted workflows to investigations while maintaining technical rigor.
• Ability to lead and train analysts during investigations and readiness efforts.
• Scripting skills (Python/PowerShell/Bash) for automation and response workflows.
• Experience with cloud service providers and malware analysis a plus.

Responsibilities

• Provide hands-on digital forensics and incident response across endpoints, memory, network, cloud, Windows, and Linux.
• Lead major cyber incident command activities, coordinating response and containment.
• Perform threat hunting with SIEM/EDR/cloud data sources and guide investigations.
• Collaborate across SOC, Threat Intelligence, Detection Engineering, and Legal teams.
• Mentor analysts during active incidents, post-incident reviews, and drills.
• Create incident strategies, findings, timelines, and executive-ready summaries.
• Develop training materials and playbooks for incident command and forensics.

Skills

Incident leadership

DFIR experience

Forensic analysis

GenAI workflows

Scripting

SOC basics

Cloud experience

Threat hunting

Malware analysis

Tools

SIEM

EDR

SOAR

Job description

UKG is seeking a Senior Staff Security Analyst - Incident Commander to join the Global Security Operations team. You will lead complex security incidents, coordinate technical response, and drive containment and recovery across enterprise environments.

The role requires hands-on DFIR experience, expert forensic analysis across networks and endpoints, and the ability to mentor analysts during investigations and tabletop exercises.