Senior Incident Response Lead - Forensics & Cloud IR

BetterCloud; Indianapolis (IN); On-site; USD 100,000 - 130,000; Full time

Job summary

BetterCloud is looking for a Staff Incident Response Analyst to serve as a technical escalation point for L2 SOC analysts. This role involves handling complex incidents requiring deep forensics, cloud incident response, and advanced technical skills.

As a key member of the security team, you will lead incident investigations, analyze artifacts, and contribute to threat hunts. Candidates must have extensive experience in incident response, particularly in AWS environments, along with proficiency in EDR tools.

Qualifications

• 6+ years of hands-on incident response experience, with at least 3 years at a senior or staff level.
• Expert-level EDR proficiency with tools like CrowdStrike Falcon and SentinelOne.
• Deep AWS incident response capability, including CloudTrail forensics.
• Strong Windows and Linux forensics skills, with ability to analyze various artifacts.
• Hands-on experience with SIEM, writing detection logic, and event correlation.

Responsibilities

• Receive and escalate L2 incidents across all severity levels.
• Perform deep-dive endpoint triage via EDR and analyze forensic artifacts.
• Lead AWS-based incident response and correlate logs for cloud-side timelines.
• Investigate identity provider incidents and respond to OAuth abuse.
• Conduct structured threat hunts in the SIEM and provide escalation support.

Skills

Incident Response

EDR proficiency

AWS IR capability

Windows forensics

Linux forensics

SIEM investigation

Technical writing

MITRE ATT&CK fluency

Tools

CrowdStrike Falcon

SentinelOne

Google SecOps/Chronicle

Splunk

Microsoft Sentinel

Volatility

Job description

BetterCloud is looking for a Staff Incident Response Analyst to serve as a technical escalation point for L2 SOC analysts. This role involves handling complex incidents requiring deep forensics, cloud incident response, and advanced technical skills.

As a key member of the security team, you will lead incident investigations, analyze artifacts, and contribute to threat hunts. Candidates must have extensive experience in incident response, particularly in AWS environments, along with proficiency in EDR tools.