SOC- Incident Response

Phoenix Business Consulting (Intelligent Enterprise); Jersey City (NJ); On-site; USD 120,000 - 180,000; Full time

Job summary

Phoenix Business Consulting (Intelligent Enterprise) is seeking an experienced L3 incident response specialist to support security incidents, investigations, and containment coordination from its Jersey City operations. The role emphasizes evidence handling, stakeholder communication, and post-incident improvements.

You will work with client SOC teams, infrastructure, IAM/PAM, cloud, and other stakeholders, leading high-severity investigations and developing remediation playbooks and executive

Qualifications

• 10+ years of experience in SOC services including incident response, digital investigation, SOC escalation, malware analysis, or security operations.
• Strong understanding of incident response lifecycle, MITRE ATT&CK, and evidence management.

Responsibilities

• Serve as an L3 incident response specialist supporting security incidents, escalations, investigations, containment coordination, and post-incident improvement.
• Work with Client SOC, infrastructure, application, IAM/PAM, cloud, network, legal, risk, and relevant third parties during security incidents.
• Provide subject-matter expertise on complex or high-severity incidents while maintaining clear evidence, timelines, stakeholder updates, and recommendations.
• Lead or support investigation of high-severity security incidents across endpoint, identity, network, cloud, email, application, and data environments.
• Perform alert validation, scoping, timeline reconstruction, root-cause analysis, impact assessment, and evidence preservation.
• Develop containment, eradication, and recovery recommendations; coordinate execution with technology owners rather than assuming infrastructure remediation ownership unless explicitly authorized.
• Manage technical war-room activities, investigation workstreams, action tracking, and escalation to Customer incident command.
• Prepare executive summaries, detailed investigation reports, lessons learned, and post-incident corrective-action recommendations.
• Maintain incident response plans, playbooks, escalation matrices, communication templates, and evidence-handling procedures.
• Coordinate with threat intelligence, threat hunting, detection engineering, vulnerability management, and external forensic providers.
• Support tabletop exercises, readiness assessments, simulation exercises, and continuous improvement of incident-response processes.

Skills

Incident response

L3 escalation

Evidence management

Threat hunting

Root-cause analysis

Executive reporting

Tabletop exercises

Tools

Splunk

EDR/XDR

ServiceNow

Python

PowerShell

SOAR

Job description

10+ years of experience in SOC services including incident response, digital investigation, SOC escalation, malware analysis, or security operations.

Responsibilities

• Serve as an L3 incident response specialist supporting security incidents, escalations, investigations, containment coordination, and post-incident improvement.
• Work with Client SOC, infrastructure, application, IAM/PAM, cloud, network, legal, risk, and relevant third parties during security incidents.
• Provide subject-matter expertise on complex or high-severity incidents while maintaining clear evidence, timelines, stakeholder updates, and recommendations.
• Lead or support investigation of high-severity security incidents across endpoint, identity, network, cloud, email, application, and data environments.
• Perform alert validation, scoping, timeline reconstruction, root-cause analysis, impact assessment, and evidence preservation.
• Develop containment, eradication, and recovery recommendations; coordinate execution with technology owners rather than assuming infrastructure remediation ownership unless explicitly authorized.
• Manage technical war-room activities, investigation workstreams, action tracking, and escalation to Customer incident command.
• Prepare executive summaries, detailed investigation reports, lessons learned, and post-incident corrective-action recommendations.
• Maintain incident response plans, playbooks, escalation matrices, communication templates, and evidence-handling procedures.
• Coordinate with threat intelligence, threat hunting, detection engineering, vulnerability management, and external forensic providers.
• Support tabletop exercises, readiness assessments, simulation exercises, and continuous improvement of incident-response processes.

Technical Requirements

• Strong understanding of incident response lifecycle, cyber kill chain, MITRE Telecommunication&CK, NIST incident-handling practices, and evidence management.
• Hands-on experience investigating Windows, Linux, Active Directory, Entra ID, AWS, Azure, network, endpoint, email, and application security incidents.
• Experience with SIEM platforms such as Splunk, EDR/XDR platforms, network telemetry, cloud logs, identity logs, and forensic tools.
• Ability to write advanced SPL or equivalent queries for investigation, correlation, and timeline construction.
• Experience analyzing phishing, account compromise, malware, ransomware, insider threat, privilege misuse, data exfiltration, web attacks, and cloud compromises.
• Knowledge of memory, disk, endpoint, network, and log forensics; familiarity with malware triage and sandbox analysis.
• Experience using ServiceNow or similar case-management platforms for incident workflow, evidence, status, and SLA tracking.
• Strong knowledge of regulatory, audit, legal-hold, and financial-services incident-reporting considerations.
• Ability to automate analysis or enrichment using Python, PowerShell, APIs, SOAR, or scripting is preferred.