incident response specialist

Lt. Col. Matt Urban Human Services Center of WNY

<p>Job Title: Crisis Response Specialist<br/>Department: Multiple</p><p>Reports To: Program Supervisor<br/>Location: Permanent Supportive Housing Facilities, other properties as needed<br/>Employment Status: Full-time/Part-time<br/>On-Call Status: Required</p><p>Job Summary:<br/>The Crisis Response Specialist is a critical position focused on fostering a safe, supportive, and respectful environment within the nonprofit&rsquo;s permanent supportive housing (PSH) and other facilities. The Crisis Response Specialist combines proactive engagement, unarmed security, and crisis intervention to build trust, reduce crises, and support tenant well-being. Through active engagement with tenants, de-escalation techniques, and collaborative problem-solving, Crisis Response Specialists work to empower residents and resolve conflicts while supporting the needs of those in crisis.</p><p>Key Responsibilities:</p><ul><li>Community-Based Security &amp; Tenant Engagement:</li><li>Serve as a visible, approachable, and proactive presence in PSH and other assigned facilities to foster a safe and inclusive environment.</li><li>Establish and maintain trusting relationships with tenants through regular, supportive interactions, prioritizing open communication and approachability.</li><li>Encourage tenant participation in creating a safe living environment, working collaboratively to identify shared safety goals and address community concerns.</li><li>Crisis Intervention &amp; De-Escalation:</li><li>Assist tenants experiencing mental health or substance use crises, using de-escalation techniques and mental health first aid, prioritizing dignity and tenant empowerment.</li><li>Engage in nonviolent intervention strategies, assessing situations to ensure a response that supports tenants&rsquo; emotional and physical safety.</li><li>Collaborate with case managers and external service providers to ensure tenants receive appropriate follow-up and support.</li><li>Serve as lead for creating and submitting reports for all incidents and maintaining incident files.</li><li>Contact 9-1-1 when necessary.</li><li>Problem-Solving:</li><li>Apply a community-centered, problem-solving approach to address conflicts and prevent crises. Work closely with tenants and staff to identify underlying causes and develop practical, sustainable solutions.</li><li>Facilitate &ldquo;safety dialogues&rdquo; with tenants to address any emerging issues and co-create an environment of mutual respect and accountability.</li><li>Use conflict mediation to prevent recurring issues, with a focus on maintaining a peaceful and supportive community.</li><li>Collaboration &amp; On-Call Crisis Support:</li><li>Collaborate with other Crisis Response Specialists and building staff to ensure continuous, on-site support during peak times.</li><li>Deploy to other properties as needed to provide crisis support, responding to emergencies as they arise and coordinating with building staff and tenants to address issues effectively.</li><li>Remain on-call during designated shifts, ready to respond to crises that require immediate attention and intervention.</li><li>Community-Building &amp; Tenant Empowerment:</li><li>Lead and participate in community-building activities that promote tenants&rsquo; sense of ownership and belonging within the housing community.</li><li>Conduct regular &ldquo;check-ins&rdquo; and build rapport with tenants, creating an environment where individuals feel comfortable discussing their concerns.</li><li>Actively encourage tenants to participate in safety initiatives and events, empowering them to contribute to the welfare of the community.</li><li>Training &amp; Continuous Improvement:</li><li>Participate in ongoing training related to trauma-informed care, mental health first aid, de-escalation, and community engagement</li><li>Engage in professional development opportunities to improve crisis intervention skills, applying learnings to support tenant needs effectively.</li><li>Regularly evaluate and adapt crisis response strategies based on feedback from tenants, staff, and external partners.</li><li>Documentation &amp; Reporting:</li><li>Maintain detailed, confidential records of incidents, interventions, and tenant interactions, upholding transparency and accountability consistent with community policing standards.</li><li>Provide accurate and timely reports to supervisors and appropriate government agencies, identifying patterns, successes, and areas for improvement in crisis response and community engagement.</li><li>Offer recommendations for enhancing community safety and improving crisis response processes, based on field experience and tenant feedback.</li></ul><p>Qualifications:</p><ul><li>Education &amp; Experience:</li><li>High school diploma or GED required, associate degree in social work, psychology, criminal justice, or a related field preferred.</li><li>Experience working with vulnerable populations, particularly those with mental health or substance use needs, is highly desirable.</li><li>Prior experience in crisis intervention, community-based security, or social services is preferred.</li><li>Skills &amp; Competencies:</li><li>Strong interpersonal and communication skills, with an emphasis on empathy, trust-building, and community engagement.</li><li>Capacity to work flexible hours, including nights and on-call shifts, as required.</li><li>Basic proficiency with computers for documentation purposes.</li><li>Certifications (preferred but not required):</li><li>Mental Health First Aid, Crisis Intervention Training, or similar crisis response certifications.</li></ul><p>Physical Requirements:</p><ul><li>Ability to move swiftly throughout facilities, respond quickly to emergencies, and remain calm in high-stress situations.</li></ul><p>Job Type: Full-time</p><p>Pay: $22.00 per hour</p><p>Benefits:</p><ul><li>403(b)</li><li>403(b) matching</li><li>Dental insurance</li><li>Employee assistance program</li><li>Health insurance</li><li>Health savings account</li><li>Paid time off</li><li>Professional development assistance</li><li>Retirement plan</li><li>Vision insurance</li></ul><p>Work Location: In person</p>

Crisis Response Specialist

Softtech

<div>
 <p>
  We are looking for a
  <strong>
   &ldquo;Senior Cyber Incident Responder&rdquo;
  </strong>
  who will be able to work with an enthusiasm for implementing pioneering steps on the subject of development solutions to join our
  <strong>
   Professional Services team.
  </strong>
 </p>
 <p>
  We believe that highly competitive solutions can only be developed by motivated and enthusiastic teams. That&rsquo;s why our team members have been selected among the top engineers and specialists in the market. We are experts in developing solutions for financial organizations. If you want to be part of this dynamic team, come &amp; join us and share our goal that is to take the technology to the next level with creative, fast, efficient, and secure solutions.
 </p>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   Here are the details of our job posting:
  </strong>
 </p>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   What makes you a good fit:
  </strong>
 </p>
 <ul>
  <li>
   Minimum of 6 years of experience, preferably in Cyber Incident Response or security operations.
  </li>
  <li>
   Bachelor's degree in engineering or a related field
  </li>
  <li>
   Advanced knowledge and experience in detecting, analyzing and responding to security incidents.
  </li>
  <li>
   Proficiency in using security tools and techniques (SIEM, IDS/IPS, EDR, EPP, Sandbox, etc.).
  </li>
  <li>
   Strong problem-solving and communication skills.
  </li>
  <li>
   Ability to work as part of a team and make quick decisions in emergency situations.
  </li>
  <li>
   Security certifications (CISSP, CEH, GIAC, OSCP etc.) are a plus.
  </li>
 </ul>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   What you&rsquo;ll experience working at Softtech:
  </strong>
 </p>
 <ul>
  <li>
   Play an active role during all phases of SOC processes
  </li>
  <li>
   Conduct technical investigation, assess the impact of security incidents and determine necessary steps to minimize damage to affected systems and data.
  </li>
  <li>
   Lead incident response efforts and coordinate with relevant teams to resolve security incidents (as applicable to the candidate&rsquo;s area of expertise)
  </li>
  <li>
   Perform static and dynamic malware analysis using sandbox environment
  </li>
  <li>
   Conduct periodic table-top exercises (TTX) to test incident response plans and procedures
  </li>
  <li>
   Regularly disseminate knowledge and coach SOC Analysts through the development of incident response procedures and playbooks
  </li>
  <li>
   Continuously update and improve Incident Response processes and policies.
  </li>
  <li>
   Provide recommendations or take actions for SIEM/SOAR use cases, reports and dashboards
  </li>
  <li>
   Stay updated on emerging cyber threats and vulnerabilities and rapidly implement proper detection methods to proactively enhance incident response capabilities
  </li>
  <li>
   Review and analyze security events regularly to detect malicious behaviors
  </li>
 </ul>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   What we offer you:
  </strong>
 </p>
 <ul>
  <li>
   Private medical insurance and group life insurance.
  </li>
  <li>
   Company contributory in individual retirement or cumulative life insurance 3 months after working with us
  </li>
  <li>
   Employee and Employer Contribution Plan for individual retirement support (Optional)
  </li>
  <li>
   Monthly meal payment
  </li>
  <li>
   Flexible remote working support
  </li>
  <li>
   Transportation fee or shuttle option according to your preference
  </li>
  <li>
   Covered travel and accommodation expenses if necessary
  </li>
  <li>
   Employee discounts - including a huge number of retailers via &Idot;&scedil; Grubu Ailem
  </li>
  <li>
   Continuously learning and development opportunities
  </li>
  <li>
   Health and well-being seminars and initiatives via Softtech Academy
  </li>
  <li>
   Employee support program through a corporate consulting firm
  </li>
  <li>
   Support for postgraduate education, including administrative leave and financial incentives for those pursuing a Master's or PhD degree
  </li>
  <li>
   Study leave and support for studying for a qualification or other accredited development relevant to your role
  </li>
  <li>
   Attending to technical congress and conferences
  </li>
  <li>
   Celebrate your birthday with a day off
  </li>
 </ul>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   What else you need to know:
  </strong>
 </p>
 <ul>
  <li>
   Hybrid working in this position.
  </li>
 </ul>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   About us:
  </strong>
 </p>
 <p>
  As one of Turkey's leading technology companies, we have been operating at a total of 6 different locations in Turkey and USA since 2006.
 </p>
 <p>
  With the strength of our experience in banking and finance industry and experienced human resources, we are developing customer-oriented solutions for our business partners operating in diverse areas.
 </p>
 <p>
  Our mission is to transform all our customers including mainly &Idot;&scedil; Bankas&inodot; into digital companies by using our efficient and high-energy ecosystem.
 </p>
 <p>
  We recognize that our people are our strength and the diverse talents. We are an equal opportunity employer and welcome applications from any individuals without any restrictions at our company.
 </p>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   <em>
    "You can reach the clarification text regarding the processing of your personal data within the scope of the Personal Data Protection Law via the link below."
   </em>
  </strong>
 </p>
 <p>
  <strong>
   <em>
    https://softtech.com.tr/kvkk-aydinlatma-metni/
   </em>
  </strong>
 </p>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   Contact us:
  </strong>
 </p>
 <p>
  If you need more information please don't hesitate to contact us.
 </p>
 <p>
  https://softtech.com.tr
 </p>
 <p>
  https://m.youtube.com/@Softtechas
 </p>
 <p>
  https://anlatsin.com/softtech
 </p>
 <p>
  https://instagram.com/softtech?igshid=YmMyMTA2M2Y=
 </p>
 <p>
 </p>
</div>


Senior Cyber Incident Responder

Partner One Capital

<div><p><b>About NetWitness</b></p><p>
NetWitness is a leader in cybersecurity incident response, delivering cutting-edge solutions for threat detection, forensics, and response. Join our elite Incident Response team to safeguard critical infrastructure against evolving cyber threats.</p><p></p><p><b><br>
Job Summary</b></p><p>
We are seeking a highly skilled Senior Cybersecurity Digital Forensics Specialist to join our NetWitness Incident Response team. In this remote role, you will lead complex digital forensics investigations, perform advanced incident response, and support clients in high-stakes environments. The ideal candidate thrives in fast-paced scenarios, combining deep technical expertise with bilingual communication skills.</p><p></p><p><b><br>
Key Responsibilities</b></p><br>
<p></p><ul><li>
Conduct thorough digital forensics examinations on endpoints, networks, memory, and cloud environments using industry-leading tools.</li><li>
Lead incident response engagements, including triage, malware analysis, threat hunting, and root cause determination.</li><li>
Develop forensic reports, timelines, and executive summaries for clients and stakeholders.</li><li>
Participate in the development or customization of tools and scripts to speed up any investigation process.</li><li>
Collaborate with cross-functional teams to mitigate threats and recommend remediation strategies.</li><li>
Travel up to 50% of the time for on-site investigations, client meetings, or incident support as needed.</li><li>
Mentor junior analysts and contribute to team knowledge-sharing initiatives.</li></ul><br>
<b>
Requirements</b><p><br>
7+years of experience in cyber security and 5+ years of hands-on experience in digital forensics and incident response (DFIR).</p><p>
SANS certifications in DFIR and Incident Response (e.g., FOR508, GCIH, or equivalent), in particular, at least one between the following:</p><br>
<p></p><ul><li>
GCFA (GIAC Certified Forensic Analyst):</li><li>
GCFE (GIAC Certified Forensic Examiner)</li><li>
GCIH (GIAC Certified Incident Handler)</li><li>
GNFA (GIAC Network Forensic Analyst)</li></ul><p></p><p>
And at least one between the following:</p><ul><li>
GCFR (GIAC Cloud Forensics Responder)</li><li>
GBFA (GIAC Battlefield Forensics and Acquisition)</li><li>
GCTI (GIAC Cyber Threat Intelligence)</li><li>
GREM (Reverse Engineering Malware) for niche forensics.</li></ul><p></p><p>
Fluency in English and Arabic (spoken and written).</p><p>
Legal entitlement to work in Qatar.</p><p>
Availability for remote work with up to 50% travel.</p><p></p><p><b><br>
Preferred Qualifications</b></p><p>
Programming skills in Python and/or SQL for automation, scripting, and data analysis.</p><p>
Additional cybersecurity certifications (e.g., GCFA, GCFE, CISSP, OSCP, or equivalent).</p><p>
Experience with tools like Volatility, EnCase, FTK, Wireshark, or NetWitness platforms.</p><p>
Familiarity with MITRE ATT&amp;CK, threat intelligence, or OT/ICS forensics.</p><b><br>
Benefits</b><p><br>
Competitive salary and benefits package.</p><p>
Flexible remote work with travel support.</p><p>
Opportunities for professional growth in a dynamic cybersecurity environment.</p><p>
Collaborative culture focused on innovation and impact.</p></div>

Senior Cybersecurity Digital Forensics Specialist

Openkyber

<div><p><b>Job Details :</b></p>
<ul><li><b>Job Title:</b> Incident Response, Logging &amp; SIEM Engineer</li>
<li><b>Location:</b> Phoenix, AZ (Hybrid 3 Days a Week Onsite)</li>
<li><b>Duration:</b> 12 Months Contract</li>
</ul><p><b>Description :</b> We're looking for an Incident Response (IR) specialist with deep expertise in logging, telemetry, and SIEM engineering who can detect, investigate, and eradicate threats across cloud and endpoint environments. You will own end-to-end detection engineering and response workflows - building high-fidelity detections, orchestrating data flows, tuning SIEM pipelines, leading incident investigations, and strengthening controls across AWS, Google Cloud Platform, and endpoint security platforms.</p>
<p><b>Key Responsibilities :</b></p>
<ul><li><b>Incident Response</b> Lead triage, investigation, containment, eradication, and recovery for security incidents across cloud, endpoint, identity, and network layers. Perform root cause analysis, draft incident timelines, and produce clear post-incident reports with corrective and preventive action plans (CAPA). Coordinate with IT, Cloud, Networking, Legal, and Compliance to drive rapid, well-documented response. Develop and run tabletop exercises, purple-team drills, and lessons-learned cycles; convert outcomes into detections and control hardening.</li>
<li><b>Logging, Telemetry &amp; SIEM Engineering</b> Design and maintain scalable logging pipelines and data flows (collection, normalization, enrichment, retention) for on-prem, AWS, and Google Cloud Platform sources. Engineer SIEM use cases, correlation rules, threat hunting queries, dashboards, and alerts with a strong focus on precision and low false-positive rates. Integrate endpoint, identity, network, and cloud telemetry (e.g., EDR/EPP, DNS, proxy, firewall, VPC Flow Logs, CloudTrail, Google Cloud Platform Audit Logs, Auth logs). Continuously tune parsers, field mappings (e.g., ECS/OCSF), and normalization to improve signal quality and response time.</li>
<li><b>Threat Detection &amp; Malware Analysis</b> Conduct static and dynamic malware analysis (strings, headers, PE/ELF artifacts, sandbox detonation, behavior profiling, memory forensics). Implement IOC/IOA-driven detections and behavior-based analytics; maintain threat intel feeds and detection pipelines. Hunt for adversary behaviors mapped to MITRE ATT&amp;CK; document hypotheses, methods, and outcomes.</li>
<li><b>Cloud Security (AWS &amp; Google Cloud Platform)</b> Build and maintain detections for cloud control plane and data plane misuse (privilege escalation, data exfiltration, anomalous IAM, persistence). Validate logging coverage and guardrails (e.g., AWS CloudTrail, GuardDuty, VPC Flow Logs; Google Cloud Platform Audit Logs, VPC Flow, Security Command Center). Partner with cloud engineering to harden identity, networking, storage, and workload protections.</li>
<li><b>Endpoint Protection &amp; Troubleshooting</b> Administer and tune EPP/EDR policies, response playbooks (isolation, kill process, quarantine, registry/network artifact cleanup). Troubleshoot logging gaps, sensor health, agent conflicts, and performance issues across Windows, macOS, and Linux.</li>
<li><b>Governance, Risk &amp; Compliance</b> Apply core information security principles (least privilege, defense-in-depth, segmentation, secure defaults, logging by design). Support regulatory and customer audits (e.g., SOC 2, ISO 27001, HIPAA, PCI DSS) by providing evidence and IR documentation.</li>
</ul><p><b>Required Qualifications :</b> Experience: 3 7+ years in Incident Response, SOC, or Threat Detection/Response with hands-on SIEM engineering. Cloud: Practical security operations in AWS and Google Cloud Platform (logging coverage, detections, IAM, network controls, data protection). Malware Analysis: Proficiency with both static (e.g., strings, disassembly triage) and dynamic (sandboxing/behavioral) techniques. Networking &amp; Data Flows: Strong grasp of TCP/IP, DNS, HTTP(S), proxying, TLS, common lateral movement patterns; able to diagram and optimize telemetry flows. SIEM: Engineering and operating at least one enterprise SIEM (e.g., Splunk, Elastic, Microsoft Sentinel, Chronicle) with query/correlation rule creation. Endpoint Protection: Experience with EPP/EDR tools (e.g., CrowdStrike, Microsoft Defender for Endpoint, SentinelOne, Carbon Black) and response workflows. Incident Handling: Proven ability to lead incidents, communicate clearly under pressure, and produce executive-ready reports. Scripting: Proficiency in at least one: Python, PowerShell, or Bash for automation and enrichment. Information Security Principles: Demonstrated application of CIA triad, zero trust concepts, hardening, and secure operations practices.</p>
<p><b>Preferred Qualifications :</b> Certifications: GCIH, GCIA, GCFA, GNFA, GCTI, GMON, OSCP, AWS Security Specialty, Google Professional Cloud Security Engineer, CISSP. Forensics: Memory/disk triage (Volatility, KAPE), PCAP analysis (Wireshark), YARA/Sigma rule authoring. Threat Intel &amp; CTI: Consuming and operationalizing TI (MISP, TAXII/STIX), enriching detections with context. Automation: SOAR playbook design (e.g., Cortex XSOAR, Swimlane, Splunk SOAR, Sentinel automation). Data Engineering: Familiarity with schema mapping (ECS/OCSF), parsing (Grok/regex), and streaming (Kafka/Kinesis/Pub/Sub).</p>
<p><b>For applications and inquiries, contact:</b> hirings@openkyber.com</p></div>

Kafka Streaming Analyst

KPMG India

<div>
 <p>
  In this position you will be responsible for providing insights to clients. To do so, you will first meet with our clients to uncover their business needs and challenges. Then, you will use your strong analytical skills to perform quantitative and observational data analyses. From these analyses, you will form and present your recommendations to our clients.
 </p>
 <p>
 </p>
 <p>
  <strong>
   Responsibilities
  </strong>
 </p>
 <ul>
  <li>
   Conduct end-to-end
   <strong>
    digital forensic investigations
   </strong>
   across endpoints, servers, cloud, and mobile devices.
  </li>
  <li>
   Support
   <strong>
    cyber incident response
   </strong>
   engagements including containment, eradication, recovery, and root cause analysis.
  </li>
  <li>
   Perform
   <strong>
    evidence acquisition, chain of custody documentation
   </strong>
   , and forensic imaging using industry-standard tools and Chain of custody procedures.
  </li>
  <li>
   Analyze logs, memory dumps, and network traffic to identify indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs).
  </li>
  <li>
   Assist in
   <strong>
    malware analysis
   </strong>
   , reverse engineering, and threat actor profiling.
  </li>
  <li>
   Prepare detailed
   <strong>
    technical reports and executive summaries
   </strong>
   for clients and internal stakeholders.
  </li>
  <li>
   Collaborate with legal, compliance, and IT teams during investigations.
  </li>
  <li>
   Contribute to
   <strong>
    post-incident reviews
   </strong>
   , lessons learned, and improvement of incident response playbooks.
  </li>
  <li>
   Previous experience with LEAs or any investigation agencies shall be preferred.
  </li>
 </ul>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   Qualifications
  </strong>
 </p>
 <p>
  <br/>
 </p>
 <ul>
  <li>
   Bachelor&rsquo;s or Master&rsquo;s degree in Computer Science, Information Security, Digital Forensics, or a related field from a reputed institute.
  </li>
  <li>
   5+ years of relevant experience in
   <strong>
    cyber forensic and incident response
   </strong>
  </li>
 </ul>
 <p>
 </p>
</div>


Consultant

Hyundai Capital America

<div></div><div><div><div><b>Who We Are</b></div><div>
Through our service brands Hyundai Motor Finance, Genesis Finance, and Kia Finance, Hyundai Capital America offers a wide range of financial products tailored to meet the needs of Hyundai, Genesis, and Kia customers and dealerships. We provide vehicle financing, leasing, subscription, and insurance solutions to over 3 million consumers and businesses. Embodying our commitment to grow, innovate, and diversify, we strive to reimagine the customer and dealer experience and launch innovative new products that broaden our market reach. We believe that success comes from within and are proud to support our team members through skill development and career advancement. Hyundai Capital America is an Equal Opportunity Employer committed to creating a diverse and inclusive culture for our workforce. We are a values-driven company dedicated to supporting both internal and external communities through volunteering, philanthropy, and the empowerment of our Employee Resource Groups. Together, we strive to be the leader in financing freedom of movement.</div><div></div><div><b>
We Take Care of Our People</b></div><div>
Along with competitive pay, as an employee of HCA, you are eligible for:</div><ul><li> Medical, dental, and vision plans with no-cost and low-cost options</li><li> Annual employer HSA contribution</li><li> 401(k) matching and immediate vesting</li><li> Vehicle purchase and lease discounts, plus monthly vehicle allowances by job level:</li></ul><div>
o Associate / Sr. Associate: $350</div><div>
o Manager / Sr. Manager: $600</div><div>
o Director: $800</div><div>
o Executive Director: $900</div><div>
o VP or Above: $1,000</div><ul><li> 100% employer-paid life and disability insurance</li><li> No-cost health and wellbeing programs, including a gym benefit</li><li> Six weeks of paid parental leave</li><li> Paid Volunteer Time Off, plus a company donation to a charity of your choice</li></ul><div></div><div><b>
What to Expect</b></div><div>
The Cybersecurity Incident Responder is a hand-on, technical role responsible for the enterprise-wide incident monitoring, threat detection and incident response function within the Security Operations Center (SOC). This position is primarily focused on incident response and active security monitoring, serving as the escalation point for security alerts triage, investigation, containment and remediation activities while ensuring integrity, confidentiality, and availability of Hyundai Capital America&rsquo;s digital assets and infrastructure. This role operates in a co-managed SOC model, overseeing and directing third party vendors of incident response resources, driving detection turning and maintaining incident response playbooks and procedures.</div><div></div><div><b>
What You Will Do</b></div><p><b><br>
Incident Response &amp; Remediation:</b></p><ul><li> Serve as a lead responder for cybersecurity incidents, correlating data from endpoints, networks, and cloud environments to identify true positives and escalate critical incidents.</li><li> Own the end to end incident lifecycle: identification, containment, eradication, recovery and post incident analysis.</li><li> Perform forensic analysis on endpoint, log and cloud data to determine root cause, scope and impact.</li><li> Develop, maintain an execute incident response playbooks and runbooks to ensure consistent and repeatable response.</li><li> Coordinate and direct MSSP and third party incident responders, validating escalation and ensuring response quality.</li><li> Maintain accurate incident records, investigation notes, and remediation documentation.</li><li> Produce incident metrics and SOC KPI&rsquo;s (MTTD, MTTR, alert volume, escalation quality)</li><li> Maintain incident response documentation, playbooks, and SOC procedures to support audits and regulatory requirements.</li><li> Lead post incident reviews, documenting lessons learned and driving measurable improvements in detection and response.</li></ul><div></div><p><b>
Security Monitoring &amp; Threat Detection:</b></p><ul><li> Actively monitor, investigate and validate security alerts across SIEM, EDR, E-Mail, identity, network and cloud platforms.</li><li> Perform advanced alert triage and threat analysis, correlating telemetry across multiple data sources to distinguish true threats from noise.</li><li> Tune and optimize SIEM detections, analytics and alerting logic and AI, to improve signal quality and reduce false positives.</li><li> Leverage threat intelligence platforms to identify emerging financial sector threats, and translate intelligence into actionable detection use cases.</li></ul><div></div><p><b>
SOC Tooling &amp; Detection Enablement:</b></p><ul><li> Develop and refine detection rules, signatures, and alert logic aligned to current threat activity.</li><li> Implement response automation and enrichment to accelerate triage and containment.</li><li> Partner with architecture and engineering teams to ensure log visibility and telemetry coverage.</li></ul><div></div><p><b>
Cross Functional Response &amp; Security Integration:</b></p><ul><li> Collaborate with IT Infrastructure, IAM, DLP, Application Security and Cloud teams during active incidents.</li><li> Support vulnerability management activities related to active incidents, threat exposure and detection gaps.</li><li> Provide incident driven security input into cloud migrations, application launches and infrastructure changes.</li></ul><div></div><div><br>
</div></div><div><b>
Qualifications</b><div></div><p><b><br>
What You Will Bring</b></p><ul><li> Minimum 5-7 years progressive experience in cybersecurity with proven knowledge in Security Operations Center practices and incident response processes.</li><li> Experience in financial services a plus.</li><li> Hands-on experience with SIEM platforms, EDR solutions, and other Monitoring and Vulnerability management tools (e.g., Splunk, Crowdstrike, Rapid 7)</li><li> Strong understanding of cyber threat landscapes, attack vectors, MITRE ATT&amp;CK framework, and adversary tactics, techniques, and procedures</li><li> Bachelor&rsquo;s degree in Computer Science, Information Security, or related field; or equivalent work experience.</li><li> Certification in one of the following: CySA+, GCIH, CompTIA Security +, GIAC GSOC, GCFA, MS SC-200, CCSP, CISM, Splunk Core Certified User, or equivalent.</li><li> Demonstrated hands-on experience in incident response lifecycle, including detection, triage, containment, eradication, recovery, and post-incident review.</li><li> Demonstrated ability to manage major incident investigations, including root cause analysis, executive reporting, and coordination with legal, compliance, and law enforcement when necessary.</li><li> Familiarity with regulatory and compliance frameworks such as HIPAA, PCI-DSS, NIST, ISO 27001, and GDPR.</li><li> Proven ability to develop and maintain incident response playbooks, escalation procedures, and SOC standard operating procedures (SOPs).</li><li> Experience with cybersecurity metrics and KPIs, and the ability to communicate risk and operational performance to executive leadership.</li><li> Analytical mindset with attention to detail.</li><li> Excellent communication and documentation skills.</li><li> Ability to work under pressure and manage multiple incidents simultaneously.</li><li> Passion for continuous learning and staying ahead of emerging threats.</li></ul><div><b>
Work Environment</b></div><div>
Employees in this class are subject to extended periods of sitting, standing, and walking, vision to monitor and moderate noise levels. Work is performed in an at home and office environment.</div><div>
</div><div><i>The posted salary range for this job takes into account the wide range of factors that are considered in making compensation decisions including but not limited to skill sets; experience and training; licensure and certifications; geographic location, and other business and organizational needs. Successful candidates may be hired anywhere in the salary range based on these factors. It is uncommon to hire candidates at or near the top of the range.</i></div><div><i>
</i></div><div><i>California Privacy Notice</i></div><div><i>
This notice only applies to our applicants who reside in the State of California.</i></div><div><i>
</i><i> Privacy Policy provides you with notice, at or before the point of collection, about the categories of personal information to be collected from you, the purposes for which your personal information is collected or used, and whether that information is sold or shared, so that you can exercise meaningful control over our use of your personal information. We are providing this notice to comply with the California Consumer Privacy Act of 2018, as amended as amended by the California Privacy Rights Act of 2020 (&ldquo;CCPA&rdquo;).</i></div><div><i>
If you have any questions about CCPA regarding California residents or HCA team members, please contact the Privacy Team at </i><i>Privacy2@hcs.com</i><i>.</i></div><div><br>
</div></div><div><b>
Primary Location</b><b>:</b> United States-California-Irvine</div><div><b>
Work Locations</b><b>:</b> Headquarters 1 3161 Michelson Dr. Ste 1900 Irvine 92612</div><div><b>
Job</b><b>:</b> Information Security</div><div><b>
Job Type</b><b>:</b> Regular</div><div><b>
Overtime Status</b><b>:</b> Exempt</div><div><b>
Schedule</b><b>:</b> Full-time</div><div><b>
Minimum Salary: $</b>100,000.00</div><div><b>
Maximum Salary: $</b>155,000.00</div><div><b>
Job Posting</b><b>:</b> Feb 23, 2026</div></div>

Cybersecurity Incident Responder

<div></div><div><div><div><b>Who We Are</b></div><div>
Through our service brands Hyundai Motor Finance, Genesis Finance, and Kia Finance, Hyundai Capital America offers a wide range of financial products tailored to meet the needs of Hyundai, Genesis, and Kia customers and dealerships. We provide vehicle financing, leasing, subscription, and insurance solutions to over 3 million consumers and businesses. Embodying our commitment to grow, innovate, and diversify, we strive to reimagine the customer and dealer experience and launch innovative new products that broaden our market reach. We believe that success comes from within and are proud to support our team members through skill development and career advancement. Hyundai Capital America is an Equal Opportunity Employer committed to creating a diverse and inclusive culture for our workforce. We are a values-driven company dedicated to supporting both internal and external communities through volunteering, philanthropy, and the empowerment of our Employee Resource Groups. Together, we strive to be the leader in financing freedom of movement.</div><div></div><div><b>
We Take Care of Our People</b></div><div>
Along with competitive pay, as an employee of HCA, you are eligible for:</div><ul><li> Medical, dental, and vision plans with no-cost and low-cost options</li><li> Annual employer HSA contribution</li><li> 401(k) matching and immediate vesting</li><li> Vehicle purchase and lease discounts, plus monthly vehicle allowances by job level:</li></ul><div>
o Associate / Sr. Associate: $350</div><div>
o Manager / Sr. Manager: $600</div><div>
o Director: $800</div><div>
o Executive Director: $900</div><div>
o VP or Above: $1,000</div><ul><li> 100% employer-paid life and disability insurance</li><li> No-cost health and wellbeing programs, including a gym benefit</li><li> Six weeks of paid parental leave</li><li> Paid Volunteer Time Off, plus a company donation to a charity of your choice</li></ul><div></div><div><b>
What to Expect</b></div><div>
The Cybersecurity Incident Responder is a hand-on, technical role responsible for the enterprise-wide incident monitoring, threat detection and incident response function within the Security Operations Center (SOC). This position is primarily focused on incident response and active security monitoring, serving as the escalation point for security alerts triage, investigation, containment and remediation activities while ensuring integrity, confidentiality, and availability of Hyundai Capital America&rsquo;s digital assets and infrastructure. This role operates in a co-managed SOC model, overseeing and directing third party vendors of incident response resources, driving detection turning and maintaining incident response playbooks and procedures.</div><div></div><div><b>
What You Will Do</b></div><p><b><br>
Incident Response &amp; Remediation:</b></p><ul><li> Serve as a lead responder for cybersecurity incidents, correlating data from endpoints, networks, and cloud environments to identify true positives and escalate critical incidents.</li><li> Own the end to end incident lifecycle: identification, containment, eradication, recovery and post incident analysis.</li><li> Perform forensic analysis on endpoint, log and cloud data to determine root cause, scope and impact.</li><li> Develop, maintain an execute incident response playbooks and runbooks to ensure consistent and repeatable response.</li><li> Coordinate and direct MSSP and third party incident responders, validating escalation and ensuring response quality.</li><li> Maintain accurate incident records, investigation notes, and remediation documentation.</li><li> Produce incident metrics and SOC KPI&rsquo;s (MTTD, MTTR, alert volume, escalation quality)</li><li> Maintain incident response documentation, playbooks, and SOC procedures to support audits and regulatory requirements.</li><li> Lead post incident reviews, documenting lessons learned and driving measurable improvements in detection and response.</li></ul><div></div><p><b>
Security Monitoring &amp; Threat Detection:</b></p><ul><li> Actively monitor, investigate and validate security alerts across SIEM, EDR, E-Mail, identity, network and cloud platforms.</li><li> Perform advanced alert triage and threat analysis, correlating telemetry across multiple data sources to distinguish true threats from noise.</li><li> Tune and optimize SIEM detections, analytics and alerting logic and AI, to improve signal quality and reduce false positives.</li><li> Leverage threat intelligence platforms to identify emerging financial sector threats, and translate intelligence into actionable detection use cases.</li></ul><div></div><p><b>
SOC Tooling &amp; Detection Enablement:</b></p><ul><li> Develop and refine detection rules, signatures, and alert logic aligned to current threat activity.</li><li> Implement response automation and enrichment to accelerate triage and containment.</li><li> Partner with architecture and engineering teams to ensure log visibility and telemetry coverage.</li></ul><div></div><p><b>
Cross Functional Response &amp; Security Integration:</b></p><ul><li> Collaborate with IT Infrastructure, IAM, DLP, Application Security and Cloud teams during active incidents.</li><li> Support vulnerability management activities related to active incidents, threat exposure and detection gaps.</li><li> Provide incident driven security input into cloud migrations, application launches and infrastructure changes.</li></ul><div><br>
</div></div><div><b>
Qualifications</b><div></div><div><b><br>
What You Will Bring</b></div><ul><li> Minimum 5-7 years progressive experience in cybersecurity with proven knowledge in Security Operations Center practices and incident response processes.</li><li> Experience in financial services a plus.</li><li> Hands-on experience with SIEM platforms, EDR solutions, and other Monitoring and Vulnerability management tools (e.g., Splunk, Crowdstrike, Rapid 7)</li><li> Strong understanding of cyber threat landscapes, attack vectors, MITRE ATT&amp;CK framework, and adversary tactics, techniques, and procedures</li><li> Bachelor&rsquo;s degree in Computer Science, Information Security, or related field; or equivalent work experience.</li><li> Certification in one of the following: CySA+, GCIH, CompTIA Security +, GIAC GSOC, GCFA, MS SC-200, CCSP, CISM, Splunk Core Certified User, or equivalent.</li><li> Demonstrated hands-on experience in incident response lifecycle, including detection, triage, containment, eradication, recovery, and post-incident review.</li><li> Demonstrated ability to manage major incident investigations, including root cause analysis, executive reporting, and coordination with legal, compliance, and law enforcement when necessary.</li><li> Familiarity with regulatory and compliance frameworks such as HIPAA, PCI-DSS, NIST, ISO 27001, and GDPR.</li><li> Proven ability to develop and maintain incident response playbooks, escalation procedures, and SOC standard operating procedures (SOPs).</li><li> Experience with cybersecurity metrics and KPIs, and the ability to communicate risk and operational performance to executive leadership.</li><li> Analytical mindset with attention to detail.</li><li> Excellent communication and documentation skills.</li><li> Ability to work under pressure and manage multiple incidents simultaneously.</li><li> Passion for continuous learning and staying ahead of emerging threats.</li></ul><div><b>
Work Environment</b></div><div>
Employees in this class are subject to extended periods of sitting, standing, and walking, vision to monitor and moderate noise levels. Work is performed in an at home and office environment.</div><div></div><div><i>
The posted salary range for this job takes into account the wide range of factors that are considered in making compensation decisions including but not limited to skill sets; experience and training; licensure and certifications; geographic location, and other business and organizational needs. Successful candidates may be hired anywhere in the salary range based on these factors. It is uncommon to hire candidates at or near the top of the range.</i></div><div></div><div><i>
California Privacy Notice</i></div><div><i>
This notice only applies to our applicants who reside in the State of California.</i></div><div><i>
</i><i> Privacy Policy provides you with notice, at or before the point of collection, about the categories of personal information to be collected from you, the purposes for which your personal information is collected or used, and whether that information is sold or shared, so that you can exercise meaningful control over our use of your personal information. We are providing this notice to comply with the California Consumer Privacy Act of 2018, as amended as amended by the California Privacy Rights Act of 2020 (&ldquo;CCPA&rdquo;).</i></div><div><i>
If you have any questions about CCPA regarding California residents or HCA team members, please contact the Privacy Team at </i><i>Privacy2@hcs.com</i><i>.</i></div><div><br>
</div></div><div><b>
Primary Location</b><b>:</b> United States-Texas-Plano</div><div><b>
Work Locations</b><b>:</b> Dallas, TX 6100 W. Plano Parkway, Suite 2000 Suite 2000 Plano 75093</div><div><b>
Job</b><b>:</b> Information Security</div><div><b>
Job Type</b><b>:</b> Regular</div><div><b>
Overtime Status</b><b>:</b> Exempt</div><div><b>
Schedule</b><b>:</b> Full-time</div><div><b>
Minimum Salary: $</b>100,000.00</div><div><b>
Maximum Salary: $</b>155,000.00</div><div><b>
Job Posting</b><b>:</b> Feb 23, 2026</div></div>

Search 8681+ Incident response specialist jobs near you this March. New roles added regularly across leading industries. Apply today.

8681 incident response specialist jobs Near Me

Crisis Response Specialist

Senior Cyber Incident Responder

Senior Cybersecurity Digital Forensics Specialist

Kafka Streaming Analyst

Consultant

Cybersecurity Incident Responder

Cybersecurity Incident Responder