cyber incident responder

QatarEnergy

<div>
 
 Primary Purpose Of The Job
 
 
 
 Act as a SME subject matter expert in Cyber Security team to provide proactive support to detect, distinguish, isolate, interrupt, suppress, advanced threats that evade existing security solutions. Responsible for handling cyber security incident response activities for QatarEnergy&rsquo;s IT and OT / Industrial areas on a 24/7 basis. Provide real-time hands-on incident management support throughout all stages of the cyber security incident lifecycle. Use state-of-the-art tools to analyse and investigate incidents and take immediate action or recommend a course of action to safeguard QatarEnergy.
 
 
 
 Required Experience And Skills
 
 
 
 10+ years&rsquo; experience working in a large-scale IT environment with focus on Information Security, and knowledge of Operational Technology.
 
 
 <ul>
 <li>
 6+ years previous Security Operations Centre Experience in conducting security investigations.
 </li>
 <li>
 Strong understanding of security incident management, malware management processes.
 </li>
 <li>
 Proven track record and demonstrated relevant experience as a key member of an incident response, malware analysis, or similar role.
 </li>
 <li>
 Advanced knowledge on Anti-Malware, Vulnerability Management, Intrusion Detection/Protection, Perimeter Security, Security Incident Management, Security Information and Event Management (SIEM), Penetration Testing (application, network, host, social).
 </li>
 <li>
 Strong understanding and experience combatting crime-ware or APT is a distinguishing factor.
 </li>
 <li>
 Strong understanding of networking principles including TCP/IP, WANs, LANs, and commonly used Internet protocols such as SMTP, HTTP, FTP, POP, LDAP. Demonstrated knowledge of security related technologies and their functions (IDS, IPS, FW, WAF, SIEM and the like).
 
 
 </li>
 </ul>
 
 Educational Qualifications
 
 
 
 Bachelor&rsquo;s degree in information security, computer science, or systems engineering.
</div>

SR. CYBER SECURITY INCIDENT RESPONDER

cFocus Software Incorporated

<div>cFocus Software seeks a n Incident Responder to support the Administrative Offices of the United States Courts (AOUSC) in Washington, DC. This position will require 4 days a week onsite at the Thurgood Marshall Building and 1 day remote with hours of 8am- 4:30pm.<h2 class="jobSectionHeader">
Position Overview</h2>
The Incident Responder supports the Administrative Office of the U.S. Courts (AOUSC) by delivering advanced cybersecurity incident response and threat hunting services across both cloud and on-premises environments. This role focuses on identifying, analyzing, and mitigating sophisticated cyber threats while strengthening detection capabilities and improving overall security posture.<h2 class="jobSectionHeader">
Key Responsibilities</h2><ul><li>
Provide incident response support for declared security incidents and proactively hunt for threats not detected through automated systems</li><li>
Conduct counterintelligence activities, develop Threat Actor (TA) dossiers, and identify adversary tactics, techniques, and procedures (TTPs)</li><li>
Analyze SIEM alerts and security events to determine risk, impact, and appropriate response actions</li><li>
Collect and analyze forensic data from compromised systems using EDR tools and custom scripts</li><li>
Track and document incidents from initial detection through final resolution</li><li>
Respond to government technical requests via ITSM platforms (e.g., HEAT, ServiceNow)</li><li>
Perform malware triage and root cause analysis</li><li>
Review open-source intelligence for emerging threats and adversary activity</li><li>
Collaborate with court IT personnel to troubleshoot and resolve endpoint detection issues</li><li>
Participate in after-action reviews and provide recommendations for improving security posture</li><li>
Attend Agile Scrum standups and report on assigned Jira tasks</li><li>
Review SOC incident reports and recommend enhancements, escalations, or re-evaluations</li></ul><h2 class="jobSectionHeader">
Required Qualifications</h2><ul><li>
Minimum of 5 years of experience in incident response across cloud and non-cloud environments, including:<ul><li>
Microsoft Azure</li><li>
Microsoft O365</li><li>
Microsoft Active Directory</li><li>
Zscaler</li></ul></li><li>
Minimum of 5 years of experience using Splunk Enterprise Security for incident response</li><li>
Minimum of 5 years of experience collecting and analyzing data using:<ul><li>
EDR tools (CrowdStrike, Qualys)</li><li>
Custom scripts (e.g., Sysmon, Auditd)</li></ul></li><li>
Experience with the following tools and technologies:<ul><li>
Microsoft Sentinel (threat hunting in Azure)</li><li>
Tenable Nessus and SYN/ACK (vulnerability management)</li><li>
NetScout (network traffic analysis)</li><li>
SPUR.us (IP/address enrichment)</li><li>
Mandiant threat intelligence feeds</li></ul></li><li>
Splunk Core Power User certification (required)</li><li>
Must possess one of the following certifications:<ul><li>
GIAC Certified Intrusion Analyst (GCIA)</li><li>
GIAC Certified Incident Handler (GCIH)</li><li>
GIAC Continuous Monitoring (GMON)</li><li>
GIAC Defending Advanced Threats (GDAT)</li></ul></li><li>
Ability to obtain a Low Risk Public Trust Suitability Determination</li></ul><h2 class="jobSectionHeader">
Key Deliverables</h2><ul><li>
QA/Security Analysis review of SOC incident reports</li><li>
Threat Actor (TA) IOC assessments</li><li>
Web Application Firewall (WAF) rule implementations</li><li>
Development of operational templates</li><li>
Advanced SME Incident Response support for Priority 1 events (engagement within 4 hours, 24/7/365)</li><li>
Comprehensive incident reports including:<ul><li>
Executive summary</li><li>
Detailed findings</li><li>
Security impact assessment</li><li>
Timeline of events</li><li>
Actions taken</li></ul></li><li>
Documentation of all work in Jira aligned with Agile processes</li><li>
Creation and maintenance of Standard Operating Procedures (SOPs) and security playbooks</li></ul><h2 class="jobSectionHeader">
Work Environment</h2>
This role requires a strong on-site presence (80%) at the AOUSC facility in Washington, DC, and active participation in a collaborative, Agile-based cybersecurity operations environment.
6tJcXxaPAw</div>

Incident Responder

Deloitte

<div>
 
 Cyber Security I Incident Response Tech Lead
 
 
 ,
 
 
 Cairo. Egypt
 
 
 
 
 Connect to your career at Deloitte
 
 
 
 
 Deloitte
 
 
 ,
 
 established globally in 1845, is the world&rsquo;s largest and leading professional services firm, providing Audit &amp; Assurance, Tax &amp; Legal and Consulting and related services to public and private clients spanning multiple industries. Present in more than 150 countries, Deloitte is distinct in its ability to help clients solve their most complex problems, from strategy to implementation.
 
 
 Deloitte innovation hub (DIH) is a strategic initiative/priority established by Deloitte North &amp; South Europe (NSE) to support our ambition to become the leading business transformation partner of choice for our clients and to expand and scale our delivery footprint across EMEA. With access to a scaled, diverse, highly skilled, motivated, and engaged workforce, DIH is delivering complex technical solutions for clients&rsquo; most complex business problems, across Portfolios that include &lsquo;Strategy &amp; Transactions&rsquo;, &lsquo;Customer&rsquo;, &lsquo;Engineering, AI &amp; Data, &lsquo;Enterprise, Technology &amp; Performance&rsquo; and &lsquo;Cyber&rsquo;. DIH is aiming to become the destination for top talents in Egypt for a long, exciting career.
 
 
 We invest in outstanding people of diverse talents and backgrounds and empower them to achieve more than they could elsewhere. Our work combines advice with action and integrity. We believe that when our clients and society are stronger, so are we. Our organization has grown in scale and diversity, providing services across the region, with our shared culture remaining the same. We aim to help clients realize their ambitions, make a positive difference in society, and maximize the success of our people. This drive fuels the commitment and humanity that run deep through our every action.
 
 
 
 Connect to your opportunity.
 
 
 
 
 Responsibilities
 
 
 
 As a
 
 Digital Forensics Incident Response Tech Lead
 
 , you will be assisting clients with response to Cyber Incidents and getting back to business. This includes data leaks, ransomware, and unusual network traffic caused by cyber criminals, ranging from insider threats to nation-state sponsored hackers. Your role would also include the following responsibilities:
 
 
 <ul>
 <li>
 Technical investigations of cyber incidents: analysis of log files, Windows event logs (windows artifacts), Linux artifacts to correlations in EDR tooling, network monitoring tools and SIEM, example of toolsets that we typically work with are Splunk, Microsoft Security Suite and CrowdStrike Falcon. It&rsquo;s most important that you can apply knowledge about (windows) forensic artifacts in any platform we face at our clients.
 </li>
 <li>
 In-depth analysis of malware, threat intelligence and other relevant sources.
 </li>
 <li>
 Tactical support such as advice on triage, containment, eradication, and broader coordination in cyber incidents.
 </li>
 <li>
 Forensic analysis of systems and networks.
 </li>
 <li>
 Memory forensics.
 </li>
 <li>
 Performing Compromise Assessments and Threat Hunting projects in SIEM and EDR tooling.
 </li>
 <li>
 Creation of custom scripts (using python) for parsing special log files, data sets and images, etc.
 </li>
 <li>
 Creation of complex timelines based on findings and observations.
 </li>
 <li>
 Member of the broader Deloitte Response Team, adding CIR skills to the overall team that includes privacy, crisis management, crisis communication, forensic investigations, and ICS/OT.
 </li>
 <li>
 Part of the EMEA and Global technical incident responder community to build a strong network and share knowledge base.
 </li>
 <li>
 Flexible working hours to support the customer during high-impact incidents.
 
 
 </li>
 </ul>
 
 Connect To Your Skills And Professional Experience
 
 
 
 To succeed in this role, you need to have the following:
 
 
 <ul>
 <li>
 Master&rsquo;s or bachelor&rsquo;s degree in computer science (or related field).
 </li>
 <li>
 One or more Forensics Certifications such as GCIH, GCFE, GCFA, GNFA, GREM.
 </li>
 <li>
 At least 3 years of experience in Cyber Incident Response and digital forensics.
 </li>
 <li>
 Minimum 6 years of experience in Cyber Security domain
 </li>
 <li>
 Hands-on skills to perform sharp and in-depth analyzes, both using tooling such as EDR and network sensors, but also manual analysis, if the tools are not available.
 </li>
 <li>
 Affinity with offensive security work (pentesting etc.) is beneficial.
 </li>
 <li>
 Posses strong passion for ransomware intelligence and work well in challenging situations, you can see both the bigger picture, as well as the smallest traces
 </li>
 <li>
 Experience in systems and/or network administration is a highly advantageous.
 </li>
 <li>
 Ability to work under pressure and keep track of the big picture while performing in-depth analysis.
 </li>
 <li>
 Trust and Confidentiality in handling client sensitive information.
 </li>
 <li>
 Ability to prioritize and take ownership, even when in unchartered territory.
 
 
 </li>
 </ul>
 
 The Following Attributes Are Essential
 
 
 
 <ul>
 <li>
 Strong written, verbal and presentation skills.
 </li>
 <li>
 A willingness to work as part of a diverse team.
 </li>
 <li>
 A commitment to continuous improvement and lifelong learning.
 </li>
 <li>
 A passion for technology and a drive to deliver secure, high-quality solutions.
 </li>
 <li>
 Strong analytical and problem-solving skills.
 </li>
 <li>
 Excellent communication and interpersonal abilities.
 </li>
 <li>
 Ability to work effectively in a fast-paced and dynamic environment.
 </li>
 <li>
 Proactive and self-motivated with a keen attention to detail.
 
 
 </li>
 </ul>
 
 Connect to your service line &ndash; Technology and Transformation
 
 
 
 Distinctive thinking, deep expertise, and collaborative working. That&rsquo;s what connects us. That&rsquo;s what makes us Deloitte. If you want to help solve some of the biggest challenges around, join us. Together, we&rsquo;ll make an impact that matters.
 
 
 
 Personal independence
 
 
 
 Regulation and controls are standard practice in our industry and Deloitte is no exception. These controls provide important legal protection for both you and the firm. We are subject to several audit regulations, one of which requires that certain colleagues abide by specific personal independence constraints. This can mean that you and your "Immediate Family Members" are not permitted to hold certain financial interests (shares, funds, bonds etc.) with audit clients of the firm. The recruitment team will provide further detail as you progress through the recruitment process.
 
 
 
 Connect to your Industry
 
 
 
 &ldquo;What attracted me to Deloitte were the endless opportunities and the collective experience of other like-minded individuals. Deloitte&rsquo;s clients include many of the world&rsquo;s largest organizations; I wanted to be part of a team that made a difference that I could be proud of.&rdquo; Dan, T&amp;T.
 
 
 
 Connect with your colleagues
 
 
 
 Location: Cairo. Egypt
 
 
 Your Work, Your Way: We call our hybrid working vision Deloitte Works. And it does. We trust you to make the right choices around where, when, and how you work. You&rsquo;ll be able to make decisions about how you work best, to be collaborative, learn from colleagues, share your experiences, build the relationships that will fuel your career and prioritize your wellbeing. Having great conversations with your team and your leadership paves the way for great collaborative ways of working.
 
 
 
 Our commitment to you
 
 
 
 Making an impact is more than just what we do: it&rsquo;s why we&rsquo;re here. So we work hard to create an environment where you can experience a purpose you believe in, the freedom to be you, and the capacity to go further than ever before.
 
 
 We want you. The true you. Your own strengths, perspective, and personality. So, we&rsquo;re nurturing a culture where everyone belongs, feels supported and heard, and is empowered to make a valuable, personal contribution. You can be sure we&rsquo;ll take your wellbeing seriously, too. Because it&rsquo;s only when you&rsquo;re comfortable and at your best that you can make the kind of impact you, and we, live for.
 
 
 Your expertise is our capability, so we&rsquo;ll make sure it never stops growing. Whether it&rsquo;s from the complex work you do, or the people you collaborate with, you&rsquo;ll learn every day. Through world-class development, you&rsquo;ll gain invaluable technical and personal skills. Whatever your level, you&rsquo;ll learn how to lead.
 
 
 
 Connect to your next step
 
 
 
 A career at Deloitte is an opportunity to develop in any direction you choose. Join us and you&rsquo;ll experience a purpose you can believe in and an impact you can see. You&rsquo;ll be free to bring your true self to work every day. And you&rsquo;ll never stop growing, whatever your level.
 
 
</div>

Deloitte Innovation Hub I Cyber Security I Digital Forensics Incident Response Tech Lead, Cairo, Egypt.

<div>
 
 Cyber Security I Incident Response Senior Engineer
 
 
 ,
 
 
 Cairo. Egypt
 
 
 
 
 Connect to your career at Deloitte
 
 
 
 
 Deloitte
 
 
 ,
 
 established globally in 1845, is the world&rsquo;s largest and leading professional services firm, providing Audit &amp; Assurance, Tax &amp; Legal and Consulting and related services to public and private clients spanning multiple industries. Present in more than 150 countries, Deloitte is distinct in its ability to help clients solve their most complex problems, from strategy to implementation.
 
 
 Deloitte innovation hub (DIH) is a strategic initiative/priority established by Deloitte North &amp; South Europe (NSE) to support our ambition to become the leading business transformation partner of choice for our clients and to expand and scale our delivery footprint across EMEA. With access to a scaled, diverse, highly skilled, motivated, and engaged workforce, DIH is delivering complex technical solutions for clients&rsquo; most complex business problems, across Portfolios that include &lsquo;Strategy &amp; Transactions&rsquo;, &lsquo;Customer&rsquo;, &lsquo;Engineering, AI &amp; Data, &lsquo;Enterprise, Technology &amp; Performance&rsquo; and &lsquo;Cyber&rsquo;. DIH is aiming to become the destination for top talents in Egypt for a long, exciting career.
 
 
 We invest in outstanding people of diverse talents and backgrounds and empower them to achieve more than they could elsewhere. Our work combines advice with action and integrity. We believe that when our clients and society are stronger, so are we. Our organization has grown in scale and diversity, providing services across the region, with our shared culture remaining the same. We aim to help clients realize their ambitions, make a positive difference in society, and maximize the success of our people. This drive fuels the commitment and humanity that run deep through our every action.
 
 
 
 Connect to your opportunity.
 
 
 
 As a
 
 Digital Forensics
 
 
 Incident Response Senior Engineer
 
 
 ,
 
 you will be assisting clients with response to Cyber Incidents &amp; getting back to business, this includes data leaks, ransomware, unusual network traffic. Cyber criminals, from insider threat to nation-state sponsored hackers.
 
 
 
 Your Role Will Also Include The Following
 
 
 
 <ul>
 <li>
 Conduct analysis of log files, Windows event logs (Windows artifacts), and Linux artifacts to identify correlations using EDR, network monitoring tools, and SIEM platforms (e.g., Splunk, Microsoft Security Suite, and CrowdStrike Falcon). The role requires applying knowledge of forensic artifacts across various client platforms.
 </li>
 <li>
 Conduct in-depth analysis of malware, threat intelligence, and other relevant sources.
 </li>
 <li>
 Provide tactical support such as advice on triage, containment, eradication, and broader coordination during cyber incidents.
 </li>
 <li>
 Perform forensic analysis of systems and networks.
 </li>
 <li>
 Execute memory forensics.
 </li>
 <li>
 Perform Compromise Assessments and Threat Hunting projects in SIEM and EDR tooling.
 </li>
 <li>
 Create custom scripts (using Python) for parsing special log files, data sets, and images, etc.
 </li>
 <li>
 Create complex timelines based on findings and observations.
 </li>
 <li>
 Act as a member of the broader Deloitte Response Team, adding CIR skills to the overall team that includes privacy, crisis management, crisis communication, forensic investigations, and ICS/OT.
 </li>
 <li>
 Partake in the EMEA and Global technical incident responder community to build a strong network and share a knowledge base.
 </li>
 <li>
 Maintain flexible working hours to support the customer during high-impact incidents.
 
 
 </li>
 </ul>
 
 Connect To Your Skills And Professional Experience
 
 
 
 To succeed in this role, you need to have the following:
 
 
 <ul>
 <li>
 At least 3 years of experience in Cyber Incident Response and digital forensics, or similar response experiences in operational environments.
 </li>
 <li>
 Hands-on skills to perform sharp and in-depth analyzes, both using tooling such as EDR and network sensors, but also manual analysis, if the tools are not available.
 </li>
 <li>
 Broader experience in other technical areas of information security, such as penetration testing, threat intelligence or security operations, is beneficial.
 </li>
 <li>
 Experience in systems and/or network administration, engineering or architecture is a highly advantageous.
 </li>
 <li>
 Ability to work under pressure and keep track of the big picture while performing in-depth analysis.
 </li>
 <li>
 Ability to apply analytical insights at an organizational level, considering wider implications and threat actor attack paths and lifecycles.
 </li>
 <li>
 Relevant academic qualifications such as Master&rsquo;s or bachelor&rsquo;s degree in computer science, information security or related fields.
 </li>
 <li>
 Relevant industry qualifications to demonstrate understanding, for example CISSP, CISM, GCFE, GCFA, GREM, GCIH, CCIM, GCIA, CCNIA, CCHIA, CCMRE or similar
 
 
 </li>
 </ul>
 
 The Following Attributes Are Essential
 
 
 
 <ul>
 <li>
 Strong written, verbal and presentation skills.
 </li>
 <li>
 A willingness to work as part of a diverse team.
 </li>
 <li>
 A commitment to continuous improvement and lifelong learning.
 </li>
 <li>
 A passion for technology and a drive to deliver secure, high-quality solutions.
 </li>
 <li>
 Strong analytical and problem-solving skills.
 </li>
 <li>
 Excellent communication and interpersonal abilities.
 </li>
 <li>
 Ability to work effectively in a fast-paced and dynamic environment.
 </li>
 <li>
 Proactive and self-motivated with a keen attention to detail.
 
 
 </li>
 </ul>
 
 Connect to your service line &ndash; Technology and Transformation
 
 
 
 Distinctive thinking, deep expertise, and collaborative working. That&rsquo;s what connects us. That&rsquo;s what makes us Deloitte. If you want to help solve some of the biggest challenges around, join us. Together, we&rsquo;ll make an impact that matters.
 
 
 
 Personal independence
 
 
 
 Regulation and controls are standard practice in our industry and Deloitte is no exception. These controls provide important legal protection for both you and the firm. We are subject to several audit regulations, one of which requires that certain colleagues abide by specific personal independence constraints. This can mean that you and your "Immediate Family Members" are not permitted to hold certain financial interests (shares, funds, bonds etc.) with audit clients of the firm. The recruitment team will provide further detail as you progress through the recruitment process.
 
 
 
 Connect to your Industry
 
 
 
 &ldquo;What attracted me to Deloitte were the endless opportunities and the collective experience of other like-minded individuals. Deloitte&rsquo;s clients include many of the world&rsquo;s largest organizations; I wanted to be part of a team that made a difference that I could be proud of.&rdquo; Dan, T&amp;T.
 
 
 
 Connect with your colleagues
 
 
 
 Location: Cairo. Egypt
 
 
 Your Work, Your Way: We call our hybrid working vision Deloitte Works. And it does. We trust you to make the right choices around where, when, and how you work. You&rsquo;ll be able to make decisions about how you work best, to be collaborative, learn from colleagues, share your experiences, build the relationships that will fuel your career and prioritize your wellbeing. Having great conversations with your team and your leadership paves the way for great collaborative ways of working.
 
 
 
 Our commitment to you
 
 
 
 Making an impact is more than just what we do: it&rsquo;s why we&rsquo;re here. So we work hard to create an environment where you can experience a purpose you believe in, the freedom to be you, and the capacity to go further than ever before.
 
 
 We want you. The true you. Your own strengths, perspective, and personality. So, we&rsquo;re nurturing a culture where everyone belongs, feels supported and heard, and is empowered to make a valuable, personal contribution. You can be sure we&rsquo;ll take your wellbeing seriously, too. Because it&rsquo;s only when you&rsquo;re comfortable and at your best that you can make the kind of impact you, and we, live for.
 
 
 Your expertise is our capability, so we&rsquo;ll make sure it never stops growing. Whether it&rsquo;s from the complex work you do, or the people you collaborate with, you&rsquo;ll learn every day. Through world-class development, you&rsquo;ll gain invaluable technical and personal skills. Whatever your level, you&rsquo;ll learn how to lead.
 
 
 
 Connect to your next step
 
 
 
 A career at Deloitte is an opportunity to develop in any direction you choose. Join us and you&rsquo;ll experience a purpose you can believe in and an impact you can see. You&rsquo;ll be free to bring your true self to work every day. And you&rsquo;ll never stop growing, whatever your level.
</div>

Deloitte Innovation Hub I Cyber Security I Digital Forensics Incident Response Senior Engineer, Cairo, Egypt.

Baylor Scott & White Health

<div>Job Summary
The Cybersecurity Incident Response Coordinator at Baylor Scott &amp; White Health is responsible for leading and coordinating the organization&rsquo;s response to cybersecurity incidents. This role ensures timely containment, recovery, and communication with key stakeholders, including Business Information Security Officers (BISOs), while keeping business units informed throughout the incident lifecycle. The coordinator drives continuous improvement through lessons learned, strategic planning, and compliance with regulatory requirements. The ideal candidate will have extensive experience in incident management, strong communication skills, and a deep understanding of cybersecurity frameworks such as NIST CSF.
Preferred Knowledge, Skills and Abilities<ul><li>
Experience in incident management, exceptional communication skills, and a good understanding of cybersecurity frameworks and processes</li><li>
Exceptional written and verbal communication skills, with the ability to clearly and concisely convey complex information to both technical and non-technical audiences</li><li>
3 -5 years of experience specifically in cybersecurity, with an emphasis on incident response and crisis management</li><li>
Familiarity with cyber incident response processes, including detection, analysis, containment, eradication, and recovery</li><li>
Experience with ITIL or a similar service management framework, particularly in relation to incident management and response</li><li>
Excellent organizational and time management skills, with the ability to prioritize and manage multiple incidents simultaneously</li><li>
Familiarity with relevant regulations and compliance requirements such as GDPR, HIPAA, or PCI-DSS</li></ul>
Preferred Certifications<ul><li>
Certified Information Systems Security Professional (CISSP) certification</li><li>
Certified Information Security Manager (CISM) certification</li><li>
CompTIA Advanced Security Practitioner (CASP+)</li></ul>
Minimum Qualifications<ul><li>
EDUCATION - Bachelor's or 4 years of work experience above the minimum qualification</li><li>
EXPERIENCE - 8 Years of Experience</li></ul></div>

Cybersecurity Incident Response Coordinator

OSC Edge

<div>This position is expected to start late Q3- early Q4 of 2026.
 
Qualified candidates are encouraged to review the full job description. Applicants are strongly encouraged to apply even if they do not meet 100% of the listed qualifications.
Final position requirements including education, training, certifications, etc., will be defined by the Government at solicitation release and may differ from what is listed here.
The Senior Cybersecurity Incident Response Administrator will lead the SIEM-based monitoring and incident response activities. This will include detecting and investigating threats, audit reporting, coordinating with cybersecurity providers, and helping ensure compliance with security requirements.
Responsibilities:
<ul><li>Leads SIEM-based monitoring and incident response activities</li>
<li>Detects and investigates threats</li>
<li>Supports audit reporting</li>
<li>Coordinates with cybersecurity providers</li>
<li>Helps ensure compliance with Army and DoD security requirements</li>
</ul>
Required Qualifications/Education and Experience:
<ul><li>High School Diploma or GED</li>
<li>Must have and maintain a Secret Clearance</li>
<li>Cybersecurity Certification (such as Certified Information Systems Security Professional (CISSP)/Information Systems Security Engineering Professional (ISSEP)/Security+/Certified Ethical Hacker (CEH/etc.)</li>
<li>10 or more years&rsquo; experience with Cybersecurity and Incident Response or related areas</li>
<li>Extensive experience managing Security Information and Event Management (SIEM) systems, including getting relevant data into the SIEM</li>
<li>Proficiency in creating and managing SIEM dashboards for security event visualization - Strong ability to monitor and investigate security events and anomalies</li>
<li>Experience in developing reporting requirements for audits and security controls</li>
<li>Knowledge of Public Key Infrastructure (PKI) and managing SSL/TLS certificates</li>
<li>Familiarity with DoD and Army web application security standards and best practices</li>
<li>Ability to review and respond to Army Cyber Tasking Orders (CTOs)</li>
<li>Experience coordinating with Cyber Security Service Providers for audit logs and incident response</li>
<li>Participation in SW Assurance reviews for application audit log validation</li>
<li>Ability to review and evaluate Information Systems Design Plans and related documents for security compliance</li>
</ul>
Preferred Qualifications/Education and Experience.
<ul><li>Bachelor's degree in computer science or equivalent years of experience</li>
<li>Familiarity with Army enterprise monitoring tools and practices</li>
<li>Strong analytical and problem-solving skills</li>
<li>Excellent communication and coordination skills</li>
<li>Experience with incident response activities</li>
<li>Knowledge of engineering change proposals and configuration management</li>
<li>Understanding of Continuity of Operation Plans and Communication Plans</li>
<li>Experience with security regulations and best industry practices</li>
<li>Ability to work effectively in a team environment and collaborate with various stakeholders</li>
</ul>
OSC Edge delivers a total rewards package that we know will attract, engage and retain top talent. Key elements of our package include a competitive base pay and a comprehensive benefits package:
We offer eligible employees with an opportunity to enroll in a variety of benefits offerings. Here are just some of our benefits for our US based positions:
<ul><li>Medical/ Dental/ Vision</li>
<li>Life insurance and AD&amp;D</li>
<li>Flexible Spending</li>
<li>Accident, Critical Illness and Hospital Indemnity coverage</li>
<li>401(k) and ROTH retirement options and company match</li>
<li>Pet Insurance</li>
<li>Identify Theft and Fraud Protection coverage</li>
</ul>
About OSC Edge:
Founded in 2008, what started as a small business has grown into a diverse and innovative global team owned by Cook Inlet Region, Inc. an Alaska Native Regional Corporation. As a US Federal contractor, we are a dedicated IT Service Provider supporting the Departments of the Army, Navy, Air Force, DoD Educational Institutions, and large corporate entities. Our expertise is in Cloud Computing, Cyber Security, Compliance Management, Enterprise Architecture, IT Support, and CSfC. If you are passionate about making a difference and thrive in a dynamic and collaborative environment, we invite you to apply to join our team.
Equal Opportunity Employer/Veterans/Disabled</div>

Senior Cybersecurity Incident Response Administrator

Target

<div>The pay range is $113,000.00 - $203,000.00
Pay is based on several factors which vary based on position. These include labor markets and in some instances may include education, work experience and certifications. In addition to your pay, Target cares about and invests in you as a team member, so that you can take care of yourself and your family. Target offers eligible team members and their dependents comprehensive health benefits and programs, which may include medical, vision, dental, life insurance and more, to help you and your family take care of your whole selves. Other benefits for eligible team members include 401(k), employee discount, short term disability, long term disability, paid sick leave, paid national holidays, and paid vacation. Find competitive benefits from financial and education to well-being and beyond at https://corporate.target.com/careers/benefits.
JOIN TARGET CYBERSECURITY AS A LEAD CYBERSECURITY ANALYST - CSIRT (INCIDENT RESPONSE)
About Us
Target is an iconic brand, a Fortune 50 company and one of America&rsquo;s leading retailers.
Target as a tech company? Absolutely. We&rsquo;re the behind-the-scenes powerhouse that fuels Target&rsquo;s passion and commitment to cutting-edge innovation. We anchor every facet of one of the world&rsquo;s best-loved retailers with a strong technology framework that relies on the latest tools and technologies&mdash;and the brightest people&mdash;to deliver incredible value to guests online and in stores. Target Technology Services is on a mission to offer the systems, tools and support that guests and team members need and deserve. Our high-performing teams balance independence with collaboration, and we pride ourselves on being versatile, agile and creative. We drive industry-leading technologies in support of every angle of the business, and help ensure that Target operates smoothly, securely, and reliably from the inside out.
As a Lead Cybersecurity Analyst on CSIRT, you will assist with leading the team as you assess information security events and incidents across the Target environment. In this role, you will use your expertise to collaborate and utilize problem solving skills as you work among a team of skilled analysts to address complex problems within a 24x7 Cyber Fusion Center (CFC) environment. You will implement new processes and procedures as identified by the CSIRT and CFC Leadership to ensure continuous improvements for Target&rsquo;s monitoring, detection, and mitigation capabilities. You will use your expert-level knowledge of Information Security to monitor SIEM and logging environments for security events and alerts to potential (or active) threats, intrusions, and/or compromises. You will lead internal training of CSIRT Analysts to ensure their continued education as an Analyst and growth. You will work to understand the global threat landscape by working with Target Cyber Threat Intel team to maintain awareness. You will review and guide requests from internal teams and will escalate information security events according to Target&rsquo;s Cyber Security Incident Response Plan. Additionally, you will lead with containment of threats and remediation of environment during or after an incident. You&rsquo;ll act as the leader during Cyber Hunt activities alongside of the Target's Cyber Hunt Team. You will leverage your expert-level knowledge to write comprehensive reports of incident investigations.
Core responsibilities of this job are described within this job description. Job duties may change at any time due to business needs.
Note: This is a shift position on Shift 2 within CSIRT. The working hours for this role are Sunday through Wednesday, 12:30pm - 10:30pm CT. If you are applying for this role you acknowledge and accept the days and times of this role.
About You<ul><li>
4-year degree, relevant certifications (e.g. GCFA, GREM, GEIR, 13Cubed), or equivalent experience</li><li>
5+ years' direct experience with Security Operations, Incident Response, or Digital Forensics</li><li>
Thorough understanding of advanced security and network concepts (Operating systems, intrusion/detection, TCP/IP, ports, etc.)</li><li>
Expertise with host and network-based security tools (Velociraptor and Google SecOps preferred)</li><li>
Expertise with network monitoring and SOAR use in a SOC environment</li><li>
Knowledge in malware analysis, memory forensics and cloud IR desired</li><li>
Ability to navigate ambiguity and develop working business relationships</li><li>
Ability to demonstrate expert-level analytical expertise, close attention to detail, excellent critical thinking, logic, and adaptive learning</li><li>
Demonstrates leadership skills that assist with driving desired outcomes</li><li>
Excellent written and oral communication skills</li></ul>
This position may be considered for a Remote or Hybrid (known internally at Target as &quot;Flex for Your Day&quot;) work arrangement based on Target's needs. A Remote work arrangement means the team member works full-time from home or an alternate location that's not a Target location, does not have a desk at a Target location and may travel to HQ up to 4 times a year. A Hybrid/Flex for Your Day work arrangement means the team member's core role may be performed either remote or onsite at a Target location depending upon what your role, team and tasks require for that day. Work duties cannot be performed outside of the country of the primary work location, unless otherwise prescribed by Target.
This position may be considered for a Remote or Hybrid (known internally at Target as &quot;Flex for Your Day&quot;) work arrangement based on Target's needs. A Remote work arrangement means the team member works full-time from home or an alternate location that's not a Target location, does not have a desk at a Target location and may travel to HQ up to 4 times a year. A Hybrid/Flex for Your Day work arrangement means the team member's core role may be performed either remote or onsite at a Target location depending upon what your role, team and tasks require for that day. Work duties cannot be performed outside of the country of the primary work location, unless otherwise prescribed by Target.
Benefits Eligibility
Please paste this url into your preferred browser to learn about benefits eligibility for this role: https://tgt.biz/BenefitsForYou_E
Americans with Disabilities Act (ADA)
In compliance with state and federal laws, Target will make reasonable accommodations for applicants with disabilities. If a reasonable accommodation is needed to participate in the job application or interview process, please reach out to candidate.accommodations@HRHelp.Target.com. Non-accommodation-related requests, such as application follow-ups or technical issues, will not be addressed through this channel.
Application deadline is : 03/26/2026</div>

Lead Cybersecurity Analyst - CSIRT (Incident Response)(Remote Or Hybrid)

Search 3861+ Cyber incident responder jobs near you this March. New roles added regularly across leading industries. Apply today.