Senior Cybersecurity Incident Responder

U.S. Bank; Charlotte (NC); On-site; USD 120,000 - 141,000; Full time

Benefits offered by this job

Healthcare (medical, dental, vision)

401(k) company match

Paid vacation

Paid holidays

Parental leave

Adoption assistance

Sick leave

Job summary

U.S. Bank is seeking a Senior Cybersecurity Incident Responder to join the Cybersecurity Incident Response team. The role investigates escalated cybersecurity events, performs hands-on analysis, and determines root cause and impact across endpoints, networks, and applications.

The position requires 4+ years of hands-on IR/DFIR experience, strong log analysis, and experience with SIEM/EDR tools. Location-based in-person work is required three days per week in a U.S. Bank location.

Qualifications

• This role requires 4+ years of hands-on cybersecurity incident response or DFIR experience.
• It requires experience investigating incidents from escalation through resolution.
• It requires strong security log analysis and telemetry investigation skills.
• It requires hands-on experience with SIEM and EDR platforms.

Responsibilities

• Lead hands-on investigation of escalated cybersecurity events and incidents.
• Determine whether activity constitutes a confirmed cybersecurity incident.
• Analyze logs, alerts, and telemetry to identify malicious activity.
• Reconstruct incident timelines including attack vectors, scope, and root cause.
• Perform digital forensics and technical analysis to support investigations.
• Use SIEM and EDR platforms during active investigations.
• Investigate activity across endpoints, networks, web apps, and firewalls.
• Identify indicators of compromise and evidence of malicious activity.
• Document findings and communicate technically supported conclusions.
• Collaborate with SOC and other teams; assist containment and recovery.
• Participate in on-call rotation roughly every 4–6 weeks.

Skills

4+ years IR/DFIR experience

log analysis

SIEM experience

EDR experience

forensics investigations

ability to work independently

on-call rotation readiness

Education

Bachelor's degree or equivalent

Tools

SIEM

EDR

Microsoft Sentinel

Microsoft Defender

Akamai security

Job description

This position is not eligible for visa sponsorship.

At U.S. Bank, we’re on a journey to do our best. Helping the customers and businesses we serve to make better and smarter financial decisions and enabling the communities we support to grow and succeed. We believe it takes all of us to bring our shared ambition to life, and each person is unique in their potential. A career with U.S. Bank gives you a wide, ever-growing range of opportunities to discover what makes you thrive at every stage of your career. Try new things, learn new skills and discover what you excel at—all from Day One.

Job Description

This position is not eligible for visa sponsorship.

U.S. Bank is seeking a Senior Cybersecurity Incident Responder to join our Cybersecurity Incident Response team. This position is responsible for investigating escalated cybersecurity events, performing hands‑on technical analysis, and determining the scope, impact, and root cause of security incidents.

This person will serve as a senior hands‑on incident responder responsible for taking security events beyond initial SOC triage and independently investigating them through resolution. This person will analyze logs and security telemetry, perform digital forensic analysis, leverage SIEM and Endpoint Detection and Response (EDR) technologies, and investigate suspicious activity across endpoints, networks, web applications, firewalls, and other security controls. The ideal candidate has significant hands‑on incident response experience and can independently analyze technical evidence to determine what occurred during a cybersecurity incident.

Location expectations

This role requires working from a U.S. Bank location three (3) or more days per week.

Main Responsibilities

• Lead hands‑on investigation of escalated cybersecurity events and incidents.
• Determine whether suspicious activity represents a confirmed cybersecurity incident.
• Analyze security logs, alerts, events, and telemetry to identify malicious or anomalous activity.
• Reconstruct incident timelines and determine attack vectors, scope, impact, and root cause.
• Perform digital forensics and technical analysis in support of cybersecurity investigations.
• Use Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) platforms during active investigations.
• Investigate suspicious activity involving endpoints, networks, web applications, firewalls, and other security technologies.
• Identify indicators of compromise (IOCs) and other evidence associated with malicious activity.
• Document investigation findings and communicate technically supported conclusions.
• Collaborate with SOC analysts and other cybersecurity teams during complex or significant incidents.
• Support containment, remediation, and recovery activities as appropriate during cybersecurity incidents.
• Participate in an on‑call rotation approximately every 4‑6 weeks and provide after‑hours support for significant cybersecurity incidents.

Must Have Skills

• 4+ years of relevant hands‑on cybersecurity Incident Response, Incident Handling, or Digital Forensics and Incident Response (DFIR) experience.
• Demonstrated experience personally investigating cybersecurity incidents from escalation through conclusion.
• Strong security log analysis and security telemetry investigation skills.
• Hands‑on experience using Security Information and Event Management (SIEM) platforms.
• Hands‑on experience using Endpoint Detection and Response (EDR) technologies.
• Experience with digital forensics, cyber investigations, or forensic analysis.
• Knowledge of network security concepts, protocols, and network activity analysis.
• Experience investigating security activity across endpoints, networks, web applications, firewalls, and related security controls.
• Ability to analyze multiple sources of technical evidence and reconstruct cybersecurity incidents.
• Ability to independently manage complex incident investigations and reach technically supported conclusions.
• Ability to participate in an on‑call rotation and respond to significant incidents outside normal business hours.

Nice to Have Skills

• Experience with Microsoft Sentinel.
• Experience with Microsoft Defender.
• Experience with Akamai security technologies.
• Advanced Security Operations Center (SOC) experience involving complex incident investigation.
• Digital Forensics and Incident Response (DFIR) experience.
• Threat hunting experience.
• Malware analysis or endpoint forensic investigation experience.
• Network forensic analysis experience.
• Red Team, penetration testing, or other offensive security experience combined with defensive incident response experience.

Basic Qualifications

• Typically a Bachelor's degree, or equivalent work experience
• Typically five or more years of relevant experience
• Skill set in security incident and event management, log file analysis, network packet analysis, incident handling in both traditional network environments as well as cloud environments
• Proficient in threat intelligence platforms, security orchestration and automation, red/blue/purple team activities

Location expectations

This role requires working from a U.S. Bank location three (3) or more days per week.

If there’s anything we can do to accommodate a disability during any portion of the application or hiring process, please refer to our disability accommodations for applicants.

Benefits

• Healthcare (medical, dental, vision)
• Basic term and optional term life insurance
• Short‑term and long‑term disability
• Pregnancy disability and parental leave
• 401(k) and employer‑funded retirement plan
• Paid vacation (from two to five weeks depending on salary grade and tenure)
• Up to 11 paid holiday opportunities
• Adoption assistance
• Sick and Safe Leave accruals of one hour for every 30 worked, up to 80 hours per calendar year unless otherwise provided by law

Review our full benefits available by employment status here.

E-Verify

U.S. Bank participates in the U.S. Department of Homeland Security E-Verify program in all facilities located in the United States and certain U.S. territories. The E-Verify program is an Internet‑based employment eligibility verification system operated by the U.S. Citizenship and Immigration Services. Learn more about the E-Verify program.

The salary range reflects figures based on the primary location, which is listed first. The actual range for the role may differ based on the location of the role. In addition to salary, U.S. Bank offers a comprehensive benefits package, including incentive and recognition programs, equity stock purchase 401(k) contribution and pension (all benefits are subject to eligibility requirements). Pay Range: $119,765.00 - $140,900.00

U.S. Bank will consider qualified applicants with arrest or conviction records for employment. U.S. Bank conducts background checks consistent with applicable local laws, including the Los Angeles County Fair Chance Ordinance and the California Fair Chance Act as well as the San Francisco Fair Chance Ordinance. U.S. Bank is subject to, and conducts background checks consistent with the requirements of Section 19 of the Federal Deposit Insurance Act (FDIA). In addition, certain positions may also be subject to the requirements of FINRA, NMLS registration, Reg Z, Reg G, OFAC, the NFA, the FCPA, the Bank Secrecy Act, the SAFE Act, and/or federal guidelines applicable to an agreement, such as those related to ethics, safety, or operational procedures.

Applicants must be able to comply with U.S. Bank policies and procedures including the Code of Ethics and Business Conduct and related workplace conduct and safety policies.

U.S. Bank is an equal opportunity employer. We consider all qualified applicants without regard to race, religion, color, sex, national origin, age, sexual orientation, gender identity, disability or veteran status, and other factors protected under applicable law.

Posting may be closed earlier due to high volume of applicants.