Senior Cyber Incident Response and Digital Forensics Lead

Jobtailor

Colorado

On-site

USD 140,000 - 190,000

Full time

14 days+

Application generator

Get a reply from this employer — a resume and cover letter tailored to exactly what they’re hiring for.

Get past ATS filters

Job summary

Jobtailor is seeking a senior cybersecurity professional to lead complex incident investigations and drive end-to-end incident response across enterprise, cloud, and on‑prem environments.

You will conduct forensics, develop detections and runbooks, and mentor SOC staff while coordinating with multiple teams and stakeholders.

Qualifications

5–10+ years in cyber security, IR, DFIR, threat hunting, or related roles.
Proven experience leading enterprise-level cyber incident investigations.
Hands-on with digital forensic analysis, evidence collection, and reporting.
Experience across cloud, hybrid, identity, endpoint, network, and on-premises environments.
Developing detections, automations, playbooks, or engineering security solutions.

Responsibilities

Lead complex cyber incident investigations across enterprise, cloud, hybrid, and on‑prem environments.
Own end-to-end incident response: triage, scoping, containment, eradication, recovery, reporting.
Investigate intrusions, ransomware, insider risk, fraud, and advanced threats.
Preserve evidence and maintain chain of custody for forensic investigations.
Produce findings, root cause analyses, and remediation recommendations.
Perform digital forensics across Windows, cloud, identity, endpoint, and network.

Skills

Cyber Incident Response

Digital Forensics

Threat Hunting

Scripting & Automation

Leadership & Mentoring

SIEM Expertise

Cloud & Hybrid Environments

Threat Intelligence

Education

Bachelor's degree in Cyber Security or related field

Tools

Microsoft Sentinel

Splunk

QRadar

Microsoft Defender XDR

CrowdStrike / SentinelOne

Azure / AWS / GCP

Job description

• Lead complex cyber incident investigations across enterprise, cloud, hybrid, and on-premises environments
• Conduct end-to-end incident response, including triage, scoping, containment, eradication, recovery, and post-incident reporting
• Investigate network intrusions, account compromise, ransomware, insider risk, fraud-related incidents, unauthorized access, and advanced threat activity
• Preserve evidence and maintain chain of custody for forensic, legal, compliance, and regulatory investigations
• Produce investigative findings, root cause analyses, executive summaries, and remediation recommendations
• Perform digital forensics and incident response across Windows, cloud, identity, endpoint, network, and application environments
• Conduct dead-box forensic examinations, artifact analysis, timeline analysis, and evidence collection
• Analyze suspicious files, malware behavior, persistence mechanisms, attacker tooling, and indicators of compromise
• Conduct proactive threat hunting and improve SIEM detections, correlation rules, KQL queries, alerts, dashboards, and response workflows
• Apply MITRE ATT&CK, threat intelligence, incident lessons learned, and attacker TTPs to improve detection coverage
• Partner with SOC, Threat Intelligence, Engineering, Platform, Infrastructure, Cloud, Identity, Application, and Security Operations teams
• Support engineering, administration, optimization, log onboarding, data normalization, telemetry validation, and use-case development for security platforms
• Build scripts, queries, automation, dashboards, and technical workflows to improve investigation speed and quality
• Use AI-assisted tools, copilots, automation, and scripting to improve investigation efficiency, reporting, and analysis
• Support threat emulation and purple team activities and assist with attack path, lateral movement, persistence, and detection validation analysis
• Serve as senior technical lead during significant cybersecurity investigations and incident response efforts
• Mentor SOC Leads, Security Analysts, Incident Responders, and Security Engineers
• Contribute to playbooks, runbooks, investigation standards, threat hunting procedures, and operational documentation
• Communicate with technical teams, leadership, Legal, HR, Compliance, and business stakeholders

Requirements

5–10+ years of experience in Cyber Security, Incident Response, DFIR, Threat Hunting, Detection Engineering, Security Operations, or related disciplines
Proven experience leading enterprise-level cyber incident response investigations
Hands-on experience with digital forensic analysis, evidence collection, malware analysis, and investigative reporting
Experience across cloud, hybrid, identity, endpoint, network, and on-premises enterprise environments
Experience developing detections, automations, playbooks, scripts, queries, or engineering solutions that improve security outcomes
Strong understanding of Microsoft Entra ID, Active Directory, Azure, Microsoft 365, identity security, and enterprise authentication concepts
Strong understanding of Windows operating systems, endpoint telemetry, authentication logs, forensic artifacts, and persistence mechanisms
Knowledge of cloud security across Azure, AWS, GCP, SaaS, identity, logging, and monitoring environments
Knowledge of incident response frameworks, cyber kill chain, MITRE ATT&CK, threat intelligence, and threat-informed defense
Knowledge of enterprise security operations, including SIEM, EDR, NDR, SOAR, vulnerability data, network security, and email security
Hands-on experience with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, or equivalent
Hands-on experience with EDR/XDR platforms such as Microsoft Defender XDR, Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, or equivalent
Experience with digital forensic tools, forensic imaging, artifact collection, timeline analysis, endpoint investigation, and evidence handling
Scripting, querying, and automation using PowerShell, Python, Kusto Query Language, SQL, APIs, or equivalent
Experience with detection engineering, threat hunting, malware triage, alert tuning, dashboards, correlation rules, and response workflows
Experience performing artifact-based investigations across endpoint, identity, email, cloud, and network data sources
Ability to analyze phishing, credential theft, lateral movement, privilege escalation, command execution, and data access
Experience producing forensic timelines, investigative findings, executive summaries, and remediation recommendations
Ability to operate independently during urgent or high-impact incidents while maintaining accuracy, documentation, and evidence integrity
Bachelor’s degree in Cyber Security, Computer Science, Information Technology, Digital Forensics, or related field is preferred; equivalent experience considered
Ability to travel to an Arrow office location as requested by Arrow leadership
Preferred certifications include GCFA, GCFE, GCIH, GCIA, GREM, GCFR, GNFA, GCTI, OSCP, CEH, CISSP, Microsoft Security Operations Analyst, Microsoft Cybersecurity Architect, or other relevant certifications

Core Competencies

Demonstrates expertise in leading complex cyber incident investigations and incident response across diverse environments, including cloud and on-premises. Proficient in digital forensics, threat hunting, and developing security automations to enhance incident detection and response.

Highest-signal resume keywords