Senior Incident Response & DFIR Lead — Remote

JustMarkets; United States; Remote; USD 140,000 - 210,000; Full time

Benefits offered by this job

Remote work

Medical budget

Education budget

Language learning budget

Wellness budget

Professional education budget

Vacation days

Job summary

JustMarkets is seeking an experienced Incident Response & DFIR Lead to join our security program on a full-time basis. You will drive incident response lifecycle, coordinate cross-functional teams, and lead post-incident reviews to prevent recurrence.

You will mentor junior DFIR specialists, develop playbooks, and act as Incident Commander for major security incidents, ensuring timely containment and evidence preservation for regulatory and legal needs.

Qualifications

• Experience leading complex security incidents and coordinating multiple teams.
• Hands-on IR lifecycle: investigation, containment, eradication, recovery, lessons learned.
• Proficient in investigating endpoint, identity, server, cloud or network compromise with EDR/XDR, SIEM.
• Ability to reconstruct attacker activity and exfiltration.
• Knowledge of digital forensics and chain-of-custody principles.
• Experience with containment actions like endpoint isolation and credential rotation.
• Experience with Windows, Linux and enterprise networking from an investigation perspective.
• Documentation of findings, timelines and evidence clearly.

Responsibilities

• Lead incident response, containment and forensic coordination for security incidents.
• Act as Incident Commander for major incidents within authority model.
• Coordinate investigation across endpoints, servers, cloud and networks.
• Develop incident playbooks and forensic checklists.
• Lead post-incident reviews and root-cause analysis.
• Provide updates to Cyber Defense leadership and stakeholders.

Skills

Incident response lifecycle

Lead complex incidents

EDR/XDR and SIEM

Digital forensics

Containment actions

Windows and Linux exposure

Documentation & timelines

Investigation coordination

Education

GCIH

GCFA

GCFE

GNFA

OSCP

CISSP

Tools

Cortex XDR

Elastic Security

Velociraptor

KAPE

Volatility

Autopsy

EnCase

FTK

Job description

JustMarkets is seeking an experienced Incident Response & DFIR Lead to join our security program on a full-time basis. You will drive incident response lifecycle, coordinate cross-functional teams, and lead post-incident reviews to prevent recurrence.

You will mentor junior DFIR specialists, develop playbooks, and act as Incident Commander for major security incidents, ensuring timely containment and evidence preservation for regulatory and legal needs.