Senior Incident Commander - Cyber Defense & Forensics Lead

UKG (Ultimate Kronos Group); Concord (NH); On-site; USD 146,000 - 209,000; Full time

Benefits offered by this job

Performance bonus

Restricted stock units (RSUs)

Benefits package

Job summary

UKG is seeking a Senior Staff Security Analyst - Incident Commander to join our Global Security Operations team. You will lead containment, investigations, and incident response across endpoints, cloud, and identity, shaping defenses for UKG and its customers.

This role requires hands-on forensics, threat hunting, and mentoring analysts; you will develop playbooks and provide executive-ready updates to leadership.

Qualifications

• 5+ years of direct hands-on digital forensics and incident response experience
• Advanced knowledge of forensic artifact areas across network, cloud, Windows, Linux, endpoint, identity, and runtime environments
• Experience leading or supporting major cyber incident command activities with coordination and reporting
• Hands-on threat hunting across SIEM, EDR, cloud, identity, and network data sources

Responsibilities

• Lead major cyber incident command activities, coordinating technical response and investigations
• Provide hands-on digital forensics and incident response across endpoints, memory, cloud, and network
• Perform threat hunting with SIEM, EDR, cloud telemetry, and forensic data sources
• Mentor and train analysts during incidents, post-incident reviews, and tabletop exercises
• Develop incident strategies, investigation plans, and executive-ready summaries

Skills

Incident response

Digital forensics

Threat hunting

Scripting (Python/PowerShell/Bash)

GenAI workflows

Mentoring

Executive communication

Tools

SIEM

EDR

SOAR

Cloud telemetry

Job description

UKG is seeking a Senior Staff Security Analyst - Incident Commander to join our Global Security Operations team. You will lead containment, investigations, and incident response across endpoints, cloud, and identity, shaping defenses for UKG and its customers.

This role requires hands-on forensics, threat hunting, and mentoring analysts; you will develop playbooks and provide executive-ready updates to leadership.