Position OverviewCowbell is seeking an experienced Incident Response Case-Lead to join our growing Resiliency Services. In this role, you will serve as a critical liaison among Cowbell's Claims Team, breach counsel, Incident Response providers, and affected policyholders - guiding organizations through the full lifecycle of a cyber incident with technical depth, legal awareness, and clear communication. You will bring a specialized blend of hands-on forensic expertise, project management discipline, and the consulting acumen required to translate complex findings for diverse stakeholders under high-pressure conditions.
Key Responsibilities- Lead and manage all phases of the incident response lifecycle - including scoping, containment, eradication, and recovery - across moderately complex, multi-system environments.
- Serve as the primary point of contact for Cowbell Claims Team, breach counsel, Incident Response providers, and policyholders throughout active engagements.
- Oversee the work of digital forensics and incident response providers, ensuring timely and accurate analysis of affected systems and environments.
- Identify and actively manage scope creep across concurrent engagements, maintaining project timelines and stakeholder alignment.
- Schedule, organize, and moderate the briefing of complex forensic findings into clear, actionable reporting tailored to technical, legal, and executive audiences.
- Operate with an understanding of Attorney-Client Privilege and Work Product Doctrine, ensuring appropriate handling of sensitive investigation materials in coordination with legal counsel.
- Collaborate cross-functionally with claims adjusters, underwriters, and external partners to support accurate incident documentation and coverage determinations.
- Contribute to the continuous improvement of Cowbell Resiliency Service's incident response methodologies, playbooks, and tooling.
Required QualificationsExperience- 4-6 years of hands-on DFIR experience, with meaningful exposure to the cyber insurance ecosystem - including work with or on behalf of insurance carriers, breach counsel, and/or policyholders.
- Demonstrated experience managing the scoping, containment, eradication, and recovery phases of cyber incidents.
- Proven track record leading moderately complex, multi-system incident investigations, with strong project management skills and an ability to identify and control scope creep.
- Ability to operate effectively within legally sensitive environments, including an understanding of Attorney-Client Privilege and the Work Product Doctrine.
- Strong consulting and communication skills, with experience presenting forensic findings to mixed audiences including legal, technical, and executive stakeholders.
Education & CertificationsA bachelor's degree in Cybersecurity, Information Security Management, Digital Forensics, Computer Science, or a related field is preferred. In lieu of a degree, equivalent professional experience combined with one or more of the following industry certifications will be considered:
- GIAC Certified Incident Handler (GCIH)
- GIAC Network Forensic Analyst (GNFA)
- CompTIA Cybersecurity Analyst (CySA+)
- Certified Information Security Manager (CISM)
- Certified Information Systems Security Professional (CISSP)
