Senior Security Incident Response Lead

Elastic; United States; Remote; USD 133,000 - 211,000; Full time

Benefits offered by this job

Health coverage for you and family

Stock program

Company 401k matching

Paid vacation days

Volunteer time off

Parental leave

Job summary

Elastic, the Search AI Company, seeks a Senior Incident Response Analyst to be on the front line of defending our customers and Elasticians. You will review alerts from Elastic Detection Engine and other sources, analyze SIEM or endpoint logs, and guide cross‑team responders to secure our environment during security events.

Ideal candidates have 3+ years in security operations or incident response in a global SaaS/cloud setting, strong log analysis skills, and excellent communication.

Qualifications

• 3+ years of experience in security operations / incident response in a global environment.
• Experience solving IT and security problems through log and system analysis.
• Ability to think innovatively about solving security problems; AI/ML exposure is a plus.
• Experience coordinating response activities with different teams to resolve issues.

Responsibilities

• Review and respond to alerts from Elastic Detection Engine and other sources.
• Provide feedback to improve detections and automate responses.
• Analyze SIEM and endpoint logs during investigations.
• Develop approaches to detect, respond to, and eradicate advanced threats.
• Identify integration points to aid event enrichment and automation.
• Gather context for security events.
• Identify root causes and remediate control gaps.
• Coordinate cross-team response activities to ensure comprehensive remediation.

Skills

Security operations

Incident response

Cloud experience

Communication skills

DoD IL5 eligibility

Tools

Elastic Stack

SIEM

Job description

Elastic, the Search AI Company, seeks a Senior Incident Response Analyst to be on the front line of defending our customers and Elasticians. You will review alerts from Elastic Detection Engine and other sources, analyze SIEM or endpoint logs, and guide cross‑team responders to secure our environment during security events.

Ideal candidates have 3+ years in security operations or incident response in a global SaaS/cloud setting, strong log analysis skills, and excellent communication.