Senior Cybersecurity Incident Response Lead (Hybrid)

General Motors Corporation; Michigan; Hybride; USD 120 000 - 180 000; Plein temps

Avantages offerts par ce poste

Relocation benefits

Hybrid work model

Résumé du poste

General Motors Corporation is seeking a Senior Cybersecurity Incident Handler to investigate and resolve enterprise security incidents across a hybrid environment in Warren, MI and Austin, TX. You will triage alerts, develop investigative plans, preserve evidence, and coordinate containment, eradication, and recovery actions using CrowdStrike, SIEM, and automation tools.

You will build and maintain workflows, dashboards, and tools in Python, GitHub Actions, and Terraform, collaborating with

Qualifications

• Incident triage, scoping, evidence collection, endpoint investigation, containment, remediation, and operational recovery.
• Windows live-response design and deployment, including multi-host workflows, timeout handling, YARA scanning, file retrieval, and file removal.
• CrowdStrike Falcon administration and engineering across Fusion Workflows, IT Automation, Next-Gen SIEM, detections, APIs, and endpoint response.
• Design of workflows for directory removal, scheduled-task removal, live-response deployment, file operations, host-online notification, detection auto-closure, containment, and BitLocker recovery actions.
• Experience developing correlation rules, including real-time NGSIEM rules and rules supporting suspected DPRK activity investigations.
• Python development for security exports, command-line utilities, API integrations, data transformation, and operational services.
• GitHub repository design, pull-request-based delivery, GitHub Actions, GitHub Pages, workflow automation, and cross-repository synchronization.

Responsabilités

• Triage and investigate security alerts and incidents involving endpoints, identities, malware, suspicious processes, persistence mechanisms, network activity, and potential data exposure.
• Develop investigative plans, gather and preserve evidence, analyze endpoint telemetry, and document findings.
• Coordinate containment, eradication, and remediation actions and provide status updates to stakeholders.
• Use CrowdStrike, Next-Gen SIEM, live-response tooling, IT Automation, and other security platforms to investigate and respond.
• Coordinate incident activities with Response, Detect, Endpoint, Engineering, Threat Intelligence, and other teams.
• Identify indicators of compromise and investigative leads to improve rules, threat hunting, and monitoring.
• Create durable incident documentation including timelines, actions, evidence, root-cause, and lessons learned.
• Maintain response playbooks, wiki content, and operational procedures.

Connaissances

Incident Response

Investigation

CrowdStrike

Endpoint Security

Python Development

CI/CD

GitHub Actions

Infrastructure as Code

Threat Intelligence

Documentation

Automation

Live Response

Velociraptor

YARA

Outils

CrowdStrike Falcon

Next-Gen SIEM

Slack

MISP

Sguil

GitHub

Confluence

Terraform

Velociraptor

GitOps

Description du poste

General Motors Corporation is seeking a Senior Cybersecurity Incident Handler to investigate and resolve enterprise security incidents across a hybrid environment in Warren, MI and Austin, TX. You will triage alerts, develop investigative plans, preserve evidence, and coordinate containment, eradication, and recovery actions using CrowdStrike, SIEM, and automation tools.

You will build and maintain workflows, dashboards, and tools in Python, GitHub Actions, and Terraform, collaborating with