Description
About the role: The Incident Response Manager plays a critical role in the cybersecurity team, responsible for responding to, analyzing, and remediating ransomware and other malicious attacks on Enterprise, and small to medium business sized networks. This role involves swiftly identifying security breaches, containing threats, restoring affected systems, and developing strategies to prevent future incidents. The ideal candidate is well-versed in digital forensics, malware analysis, and has experience working under pressure during cyber crises.
What You'll Do:
Incident Response: Lead and coordinate efforts to respond to ransomware and other cyber-attacks. This includes identifying, containing, eradicating, and recovering from security incidents.
Threat Analysis: Conduct thorough investigations to understand the nature and scope of cyber attacks, including analyzing malware, identifying attack vectors, and determining the extent of data compromise.
Remediation: Develop and implement remediation strategies to restore affected systems and services, ensuring that security vulnerabilities are addressed and business operations are resumed safely.
Forensics: Collect and preserve digital evidence during security incidents for further analysis, legal, and compliance purposes. Perform root cause analysis to understand how attacks were executed.
Collaboration: Work closely with other IT teams, external vendors, and law enforcement agencies as needed to manage and resolve security incidents effectively.
Documentation: Maintain detailed records of incidents, including timelines, actions taken, and lessons learned. Provide comprehensive reports to stakeholders and management.
Continuous Improvement: Review and enhance incident response protocols and tools based on lessons learned from past incidents. Contribute to developing training materials and conducting drills to improve organizational readiness.
Security Monitoring: Support proactive threat detection by working with the security operations center (SOC) to monitor network traffic, analyze security alerts, and identify potential threats before they become incidents.
Stay Current: Keep up to date with the latest trends, tactics, and technologies used by cyber attackers and recommend improvements to security measures to defend against evolving threats.
What Skills & Experience You'll Need:
3-5 years of Information Security and Incident Response experience.
Previous experience as an Incident Response Manager
Strong analytical and problem-solving skills and the ability to exercise sound judgement on issues with significant impact on business operations.
Strong organizational, decision making, verbal and written communication skills
Ability to work independently with minimum supervision and to take on additional tasks as required.
Ability to work with small teams to solve complex technical problems.
Functional knowledge of Firewalls, Switches/Routers and Network/System Intrusion Detection or Prevention Systems (IDS/IPS).
Prior experience as a Systems/Network Administrator, Cybersecurity Command Center Analyst, Security Analyst, Incident Response Analyst.
Industry certifications such as: CompTIA Network+, Security+ Certifications; GIAC GCIA, GMON or GCIH; MCSE, MCSA strongly desired.
24x7 NOC/SOC experience, working for a MSSP, or internal enterprise SOC teams.
Experience with SIEM/IDS/Endpoint technologies such as Splunk, ELK, LogRhythm, Intel Security, HP Arcsight, AlienVault USM, IBM QRadar, Azure Sentinel, Crowdstrike, etc.
Experience with common methods of exploitation, such as buffer overflows, cross-site scripting, etc.
Programming/shell scripting experience highly desirable (PERL, Python, Java, shell scripts, PowerShell, etc.)
Hands-on Linux experience.
Can-do attitude with a calm demeanor and ability to stay poised under high pressure situations.
A Bachelor's degree in Computer Science, Cyber Security, or other tech-related degree high preferred.
