Senior Security Incident Responder

Insight Global; United States; Remote; USD 19,000 - 38,000; Full time

Job summary

Insight Global is seeking a Senior Security Incident Responder to lead enterprise-wide cybersecurity incident handling from discovery through recovery. This remote role in India requires coordinating with business owners, legal, privacy, compliance, and infra teams as part of a CSIRT.

The candidate will leverage SIEM/EDR tools, conduct root-cause analysis, and drive playbooks, automation, and threat intel to reduce risk.

10+ years of experience and strong communication skills are required.

Qualifications

• Lead investigations of major cybersecurity incidents and security breaches.
• Coordinate with business owners, legal, privacy, compliance, and infra teams during incidents.
• Serve as a technical leader during major security incidents.

Responsibilities

• Lead investigation, containment, eradication, and recovery of enterprise incidents.
• Coordinate response across cybersecurity, infrastructure, cloud, and applications teams.
• Develop and optimize incident response playbooks, runbooks, and standard operating procedures.
• Design automation and SOAR workflows to improve investigation efficiency.
• Provide incident communications and executive briefings.

Skills

Incident response

SOC operations

Threat detection

Forensic investigation

Threat hunting

Stakeholder coordination

Automation / SOAR

Cloud security

Log analysis

Communication

Education

Bachelor's degree in Cybersecurity/Information Security/CS/IT or related field

Tools

Microsoft Sentinel

Splunk

QRadar

Elastic

LogRhythm

Microsoft Defender

CrowdStrike

SentinelOne

Carbon Black

Job description

Job Title Senior Security Incident Responder.

Location: Remote in India

Shift Time : 3:30 PM-1130 PM- IST.

EST : 6:00 AM to 3:00 PM

Client Note:

They have to be high level incident responders or commanders that directly handle/manage enterprise-wide large scale cybersecurity threats like cloud compromise, credential compromise, ransomware, data exposure, etc. - not looking for L2 or L3 SOC people. they'll have that background, but should be true incident responders, coordinating with business owners, legal, privacy, compliance, and infra teams to remediate these types of incidents. They should be part of CSIRT team

They already have a team handling phishing and malware, this is much bigger incidents

Job Description

We are seeking a Senior Security Incident Responder who will be responsible for leading the investigation, containment, eradication, and recovery of cybersecurity incidents across the enterprise. This role serves as a technical leader during major security incidents, leveraging security monitoring tools, threat intelligence, forensic techniques, and advanced analytics to determine attack scope, impact, root cause, and remediation actions.

The role requires strong expertise in security operations, incident response, threat detection, log analysis, and security tooling, as well as the ability to coordinate response activities across technical teams, business stakeholders, legal, privacy, compliance, and third-party vendors. The individual will also drive continuous improvement of SOC capabilities through playbook development, automation, detection tuning, and response orchestration.

• Lead the investigation and response of major cybersecurity incidents, including ransomware, phishing, insider threats, malware, credential compromise, and data breaches.
• Perform incident triage, analysis, containment, eradication, recovery, and post-incident activities.
• Conduct root cause and impact analysis to identify attack vectors, affected systems, and business impact.
• Analyze security alerts, logs, network traffic, endpoint telemetry, cloud activity, and threat intelligence to determine the scope of incidents.
• Utilize SIEM, EDR, NDR, cloud security, email security, and identity security tools to investigate and respond to security events.
• Correlate data from multiple security technologies to identify malicious activity, reconstruct attack timelines, and uncover threat actor behaviour.
• Perform threat hunting activities and identify indicators of compromise (IOCs), attacker tactics, techniques, and procedures (TTPs).
• Serve as the technical lead during major incidents and coordinate response efforts across cybersecurity, infrastructure, cloud, application, legal, privacy, compliance, and business teams.
• Provide clear incident communications, status updates, executive briefings, and ensure proper documentation and regulatory reporting.
• Develop, maintain, and optimize incident response playbooks, runbooks, and standard operating procedures.
• Design and implement automation and SOAR workflows to improve investigation efficiency, response consistency, and SOC effectiveness.
• Create and improve detection rules, use cases, and response processes while driving continuous improvements through lessons learned, threat intelligence, and incident trend analysis.

Required Skills & Experience

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or related field.
• 10+ years of experience in cybersecurity, including significant experience in Security Operations Center (SOC) and Incident Response functions.
• Proven experience leading investigations of major cybersecurity incidents and security breaches.
• Strong understanding of incident response methodologies, attacker tactics, and forensic investigation techniques.
• Experience working in enterprise or global environments with complex security infrastructures.
• Ability to coordinate technical and non-technical stakeholders during high-pressure incident situations.
• Experience working in one of the SIEM platforms (Microsoft Sentinel, Splunk, QRadar, Elastic, LogRhythm, etc.)
• Experience working in one of the Endpoint Detection and Response platforms (Microsoft Defender, CrowdStrike, Sentinel One, Carbon Black, etc.)
• Experience with query languages and scripting (KQL, SPL, Python, PowerShell, Bash/Shell scripting)
• Experience with API integrations and workflow automations

Nice to Have Skills & Experience

• Preferred Certifications:
• GIAC Certified Incident Handler (GCIH)
• GIAC Certified Forensic Analyst (GCFA)
• GIAC Certified Enterprise Defender (GCED)
• CISSP
• Certified SOC Analyst (CSA)
• Microsoft Security Operations Analyst Associate
• SANS Incident Response training or equivalent