Senior DFIR Lead - Global Incident Response Commander

RGA; Missouri; On-site; USD 127,000 - 189,000; Full time

Job summary

RGA seeks a Principle Incident Response Engineer to lead complex investigations, strengthen enterprise resilience, and guide security teams across global environments. This role blends hands-on DFIR, strategic advisory, and security program leadership, delivering measurable outcomes and on-call support.

Requires 8+ years in incident response, strong forensics, and proven collaboration with legal, compliance, and executive audiences.

Qualifications

• 8+ years in incident response, DFIR, or security operations.
• Proven experience leading major cyber incidents.
• Strong forensics capability using standard tools.
• Experience with Splunk, Defender, CrowdStrike, ServiceNow SIR, and cloud tech.
• Knowledge of networks, logging, threat hunting methods.
• Excellent written and verbal communication for exec audiences.
• Ability to manage multiple priorities in a global enterprise.

Responsibilities

• Lead enterprise incident response and cyber crisis engagements from detection through recovery.
• Direct host, network, cloud, identity, and SaaS investigations across Windows, Linux, macOS, M365, AWS, Azure, and hybrid envs.
• Perform advanced threat hunting and compromise assessments using SIEM, EDR, forensic, and threat intel tools.
• Develop containment, eradication, and remediation strategies aligned to business risk.
• Produce executive briefings, technical reports, and post-incident reviews.
• Partner with legal, compliance, privacy, audit, and external stakeholders when required.
• Drive adoption of AI-assisted workflows to improve investigation speed and reporting quality.
• Support the 24/7 on-call rotation.

Skills

Incident response leadership

Cyber crisis management

Threat hunting

Digital forensics

Executive communication

Global stakeholder collaboration

On-call rotation

Analytical thinking

Multitasking in enterprise

Security operations

Strategic security advisory

Education

Master’s degree in Arts/Sciences (MA/MS) or equivalent experience required

Tools

Splunk

Microsoft Defender

CrowdStrike Falcon

ServiceNow SIR

Cloud security technologies

FTK

Encase

X-Ways

SIFT

AWS

M365 suite

IAM/AAA technologies (AD, Okta, OpenID, SAML, Oauth, JWT)

SIEM

EDR

Job description

RGA seeks a Principle Incident Response Engineer to lead complex investigations, strengthen enterprise resilience, and guide security teams across global environments. This role blends hands-on DFIR, strategic advisory, and security program leadership, delivering measurable outcomes and on-call support.

Requires 8+ years in incident response, strong forensics, and proven collaboration with legal, compliance, and executive audiences.