Staff Incident Responder

About the role

As a Staff Incident Responder you will be a senior technical member of a global, follow-the-sun incident response team, investigating and responding to cybersecurity incidents across endpoint, network, identity, cloud and SaaS environments. You will handle incidents from triage through containment, eradication, recovery and lessons learned, and take part in on-call and major-incident rotations. The role suits someone who works with minimal direction, makes sound judgments under pressure and acts as a visible partner to teams outside Security.

Key responsibilities

• Run incident response across incident types and severities using EDR, SIEM, cloud security, identity, email, network and other investigative tools.
• Produce clear investigation records, technical findings, incident reports and stakeholder updates.
• Serve as a technical escalation point and, when assigned, incident commander for high-severity and complex incidents.
• Reconstruct attacker activity, identify TTPs, determine root cause and impact, and assess attribution where evidence allows.
• Develop containment, eradication and recovery plans with IT, Cloud, Application, Identity, Legal, Privacy, Communications and business leaders.
• Run threat hunts and turn incident findings into new detections, fewer false positives and stronger controls.
• Drive security-hardening initiatives and track corrective actions to closure.
• Evaluate and responsibly apply AI-assisted and agentic capabilities to improve triage, detection and response, with human oversight.
• Improve playbooks, procedures, tooling, automation and forensics using lessons learned.
• Mentor responders and share technical knowledge across the global CIRT.
• Take part in a rotating on-call schedule, including after-hours, weekend and holiday response, with complete follow-the-sun handoffs.

Required profile

• Bachelor's degree in Computer Science, Cybersecurity or a related field, or equivalent practical experience.
• Demonstrable hands-on experience in security operations or incident response, owning high-impact incidents end to end.
• Ability to prioritize and complete multiple tasks with little supervision.
• Willingness to join a rotating on-call schedule, including occasional after-hours, weekend and holiday response.
• Strong verbal and written communication, able to explain technical risk to non-technical stakeholders.

What helps you succeed

• Critical thinking and analytical rigor, distinguishing facts from assumptions.
• Deep technical curiosity about attacker techniques and how systems fail.
• Comfort working independently and within an incident-command structure.
• Composure and methodical decision-making under pressure.
• Effective teamwork and clear documentation for clean handoffs.