Senior Incident Response Leader — Remote

NorthAB LLC; United States; Remote; USD 150,000 - 180,000; Full time

Job summary

North is seeking a Principal Incident Response Analyst to lead its most complex security incidents from detection through recovery, with remote flexibility. This role combines incident response, detection engineering, and threat hunting at the highest level across payments/fintech environments.

You will mentor engineers, develop incident response playbooks, and coordinate with SOC, IT, and engineering teams to close visibility gaps while maintaining executive-level communications during active

Qualifications

• Bachelor’s degree in a technical field, or equivalent professional experience
• 7+ years of hands-on information security experience, with deep, demonstrated subject-matter expertise in incident response, and strong working proficiency in detection engineering and threat hunting
• Demonstrated track record independently leading complex, high-severity security incidents from detection through recovery, without supervision
• Experience mentoring or providing technical leadership to other security engineers and analysts
• Excellent written and verbal communication skills, including the ability to translate technical findings for non-technical stakeholders and leadership
• Deep, hands-on expertise leading end-to-end incident response (triage, containment, eradication, recovery, and root cause analysis) on complex or novel incidents, independently
• Advanced digital forensics skills across endpoint, network, cloud, and identity sources, including memory and disk forensics
• Advanced experience with EDR/XDR platforms and log analysis across diverse sources: endpoint, network, cloud, and identity
• Strong working knowledge of detection engineering: writing, tuning, and validating detection content in a SIEM or NG-SIEM platform
• Working proficiency in hypothesis-driven threat hunting methodology, informed by threat intelligence and the MITRE ATT&CK framework
• Deep working knowledge of the MITRE ATT&CK framework and its practical application to incident response, detection gap analysis, and hunt prioritization
• Strong scripting or automation experience (Python, PowerShell, or similar) applied to security use cases AND/OR experience using LLM coding tools such as Claude Code, Gemini CLI, or Codex
• Solid understanding of networking, cloud infrastructure (AWS especially, but also Azure and GCP), Windows/Linux systems, and identity platforms
• Working knowledge of PCI-DSS or a comparable compliance framework
• Demonstrated ability to lead high-pressure, ambiguous, cross-functional incident investigations with minimal oversight

Responsibilities

• Serve as principal escalation point and lead investigator for complex, high-severity incidents, end-to-end
• Independently triage, investigate, contain, eradicate, and recover from incidents across endpoints, networks, cloud, identity, and apps
• Lead full-scope forensic investigations and reconstruct attack timelines from initial access through impact
• Translate investigation findings into clear narratives for engineering teams and leadership
• Own and evolve incident response processes, docs, and playbooks with lessons learned
• Lead root cause analysis and cross-team remediation of systemic gaps
• Serve as senior technical lead during major incidents coordinating across IT, legal, compliance, and leadership
• Provide case-level guidance and mentorship to other incident responders and SOC analysts
• Participate in or lead on-call rotation for critical incident response
• Translate incident findings into new or improved detection logic and SIEM content
• Maintain and improve MITRE ATT&CK coverage and gap analysis for detections
• Review detection logic for accuracy and false positives; collaborate with detection engineering
• Contribute documentation of known coverage and detection gaps from incidents and hunts
• Conduct proactive threat hunts based on incident trends and threat intel
• Surface undetected compromises and strengthen incident response readiness
• Prioritize hunts for payments/fintech-adjacent techniques and paths
• Collaborate with threat intel sources to inform hunt hypotheses
• Document hunt methodology, findings, and follow-on actions

Skills

Incident response

Detection engineering

Threat hunting

Leadership

Forensics

Scripting (Python)

Cloud security

PCI-DSS

Education

Bachelor’s degree in a technical field

Tools

CrowdStrike NG-SIEM

Splunk

Microsoft Sentinel

EDR/XDR platforms

Job description

North is seeking a Principal Incident Response Analyst to lead its most complex security incidents from detection through recovery, with remote flexibility. This role combines incident response, detection engineering, and threat hunting at the highest level across payments/fintech environments.

You will mentor engineers, develop incident response playbooks, and coordinate with SOC, IT, and engineering teams to close visibility gaps while maintaining executive-level communications during active