Senior Cyber Incident Handler: Automate & Lead Response

General Motors; Austin (TX); Hybrid; USD 110,000 - 160,000; Full time

Job summary

General Motors in Austin, TX is seeking a Cyber Security Incident Handler to triage, investigate, contain, and recover from security incidents across the enterprise. You will develop hypotheses, collect evidence, and coordinate actions with engineering, IT, and security stakeholders.

You will build repeatable processes and automation using Python, GitHub Actions, Terraform, and CI/CD workflows, and enable threat intel integrations with MISP, Slack, Confluence, and other platforms.

Qualifications

• Incident triage, scoping, evidence collection, endpoint investigation, containment, remediation, and operational recovery.
• Windows live-response design and deployment, including multi-host workflows, timeout handling, YARA scanning, file retrieval, and file removal.

Responsibilities

• Triage and investigate security alerts and incidents involving endpoints, identities, malware, suspicious processes, persistence mechanisms, network activity, and potential data exposure.
• Develop investigative plans, gather and preserve relevant evidence, analyze endpoint telemetry and live-response results, and document findings.
• Perform or coordinate approved containment, eradication, and remediation actions, including host isolation, live response, file retrieval or removal, directory cleanup, scheduled-task removal, and related endpoint actions.
• Use CrowdStrike Falcon, Next-Gen SIEM, live-response tooling, IT Automation, and other security platforms to investigate and respond to incidents.
• Coordinate incident activities with Response, Detect, Endpoint, Engineering, Insider Threat, Threat Intelligence, and other stakeholders.
• Assess incident severity, business impact, scope, and risk; elevate appropriately and provide clear status updates to technical and leadership audiences.
• Identify indicators of compromise and investigative leads, and collaborate with detection and intelligence teams to improve correlation rules, threat hunting, and monitoring coverage.
• Create complete, accurate, and durable incident documentation, including timelines, investigative actions, evidence, containment decisions, root-cause findings, and lessons learned.
• Contribute to and maintain response playbooks, wiki content, workflow documentation, and operational procedures.
• Identify recurring operational friction and help develop secure automation, scripts, dashboards, integrations, and workflows that improve responder efficiency.
• Test new response capabilities, validate safeguards and permissions, and support deployment across appropriate development, test, and production environments.
• Participate in incident reviews, process improvement, mentoring, and knowledge-sharing activities across Security Operations.

Skills

Incident triage

Investigation plan development

Evidence collection

Endpoint analysis

Automation scripting (Python)

Documentation

Stakeholder coordination

Tools

CrowdStrike Falcon

Next-Gen SIEM

Live-response tooling

GitHub Actions

Terraform

GitOps

Sguil/Confluence

Job description

General Motors in Austin, TX is seeking a Cyber Security Incident Handler to triage, investigate, contain, and recover from security incidents across the enterprise. You will develop hypotheses, collect evidence, and coordinate actions with engineering, IT, and security stakeholders.

You will build repeatable processes and automation using Python, GitHub Actions, Terraform, and CI/CD workflows, and enable threat intel integrations with MISP, Slack, Confluence, and other platforms.