Senior Cybersecurity Incident Response Lead

US Bank; Minneapolis (MN); On-site; USD 120,000 - 180,000; Full time

Job summary

U.S. Bank in Minnesota is seeking a Senior Cybersecurity Incident Responder to join our Cybersecurity Incident Response team. You will lead hands-on investigations of escalated security events, analyze logs and telemetry, and determine root cause across endpoints, networks, and applications.

The role requires 4+ years of DFIR/incident response experience and the ability to work on-site, participate in an on-call rotation, and collaborate with SOC analysts to contain and remediate incidents.

Qualifications

• Typically a Bachelor's degree, or equivalent work experience
• Typically five or more years of relevant experience
• Skill set in security incident and event management, log file analysis, network packet analysis, incident handling in both traditional network environments as well as cloud environments
• Proficient in threat intelligence platforms, security orchestration and automated response

Responsibilities

• Lead hands-on investigation of escalated cybersecurity events and incidents.
• Determine whether suspicious activity represents a confirmed cybersecurity incident.
• Analyze security logs, alerts, events, and telemetry to identify malicious or anomalous activity.
• Reconstruct incident timelines and determine attack vectors, scope, impact, and root cause.
• Perform digital forensics and technical analysis in support of cybersecurity investigations.
• Use SIEM and EDR platforms during active investigations.
• Investigate suspicious activity involving endpoints, networks, web applications, firewalls, and other security technologies.
• Identify indicators of compromise and other evidence associated with malicious activity.
• Document investigation findings and communicate technically supported conclusions.
• Collaborate with SOC analysts and other cybersecurity teams during complex or significant incidents.
• Support containment, remediation, and recovery activities as appropriate during cybersecurity incidents.
• Participate in an on-call rotation approximately every 4-6 weeks and provide after-hours support for significant cybersecurity incidents.

Skills

Incident response

Digital forensics

Log analysis

SIEM

EDR

On-call readiness

Endpoint/network security

Threat intelligence

Education

Bachelor's degree or equivalent

Tools

Microsoft Sentinel

Microsoft Defender

Akamai security technologies

Job description

U.S. Bank in Minnesota is seeking a Senior Cybersecurity Incident Responder to join our Cybersecurity Incident Response team. You will lead hands-on investigations of escalated security events, analyze logs and telemetry, and determine root cause across endpoints, networks, and applications.

The role requires 4+ years of DFIR/incident response experience and the ability to work on-site, participate in an on-call rotation, and collaborate with SOC analysts to contain and remediate incidents.