Senior Security Incident Commander & Forensics Lead

UKG (Ultimate Kronos Group); Salem (OR); On-site; USD 126,000 - 209,000; Full time

Job summary

UKG is seeking a Senior Staff Security Analyst - Incident Commander to join the Global Security Operations team. You will lead major cyber incidents, coordinate cross‑functional response, and drive containment and recovery while performing hands‑on forensics and threat hunting across multiple environments.

You will mentor analysts, craft incident strategies, and develop training materials to improve detection, response, and operational readiness across the organization.

Qualifications

• 5+ years of direct hands-on digital forensics and incident response experience.
• Advanced knowledge of forensic artifact areas across network, cloud, Windows, Linux, endpoint, identity, and runtime environments.
• Experience applying GenAI-assisted workflows to investigation, summarization, hunt development, scripting, or analyst enablement.

Responsibilities

• Lead complex security incidents, coordinating technical response and actions across teams.
• Perform hands-on threat hunting across SIEM, EDR, cloud telemetry, identity logs, network data, and artifacts.
• Guide and mentor analysts during incidents, post-incident reviews, and tabletop exercises.
• Develop incident strategies, investigation plans, and technical summaries for leadership.
• Create training materials, playbooks, and exercises for incident command and forensics capabilities.
• Use scripting to accelerate investigations and standardize responses.

Skills

Digital forensics

Incident response

Threat hunting

GenAI workflows

Scripting (Python/PowerShell/Bash)

SOC operations

Public cloud security

Mentoring/training

Tools

SIEM

EDR

SOAR

Forensic tooling

Case management

Job description

UKG is seeking a Senior Staff Security Analyst - Incident Commander to join the Global Security Operations team. You will lead major cyber incidents, coordinate cross‑functional response, and drive containment and recovery while performing hands‑on forensics and threat hunting across multiple environments.

You will mentor analysts, craft incident strategies, and develop training materials to improve detection, response, and operational readiness across the organization.