This position is responsible for leading security investigations, coordinating incident response activities, advancing detection capabilities, and helping strengthen the processes, technologies, and automation that support a mature and evolving security program. The successful candidate will combine strong technical expertise with sound judgment, partnering across security, technology, legal, privacy, risk, and business teams to identify, contain, and mitigate threats while continuously improving the firm's defensive capabilities.
PRIMARY RESPONSIBILITIES - Lead incident response activities through triage, investigation, containment, remediation, recovery, and post-incident analysis.
- Investigate security events across endpoint, identity, network, cloud, email, and SaaS environments.
- Conduct threat hunting and forensic investigations to identify malicious, suspicious, or unauthorized activity.
- Develop and enhance detection logic, alerting, playbooks, workflows, and automation to improve operational effectiveness and response capabilities.
- Serve as a senior escalation point for complex and high-priority security incidents.
- Assess emerging threats, including risks associated with AI-enabled technologies, and support the continuous evolution of security operations.
- Prepare clear and actionable investigation reports and communicate findings to both technical and non-technical stakeholders.
- Mentor team members and contribute to the ongoing growth and maturity of the incident response and security operations program.
QUALIFICATIONS- Six (6)+ years of experience in incident response, digital forensics, security operations, or a related cybersecurity discipline.
- Experience investigating threats across enterprise endpoint, cloud, identity, network, email, and SaaS environments.
- Strong expertise in SIEM technologies, log analysis, event correlation, threat hunting, and incident investigation.
- Experience with EDR/XDR platforms and host-based investigation techniques across enterprise environments.
- Demonstrated ability to improve detections, streamline response processes, and drive operational improvements.
- Experience with security automation, SOAR platforms, PowerShell, Python, KQL, or similar scripting and query languages is preferred.
- Strong communication, analytical, and problem-solving skills, with the ability to perform effectively during complex investigations and active incidents.
- Bachelor's degree in information technology, computer science, cybersecurity, or equivalent experience.
- Industry certifications such as GCIH, GCIA, GCFA, GCFE, GNFA, or CISSP preferred.
ADDITIONAL INFORMATIONCore hours are Monday through Friday, 9:00 a.m. - 6:00 p.m., with one hour for lunch. This is an exempt position and requires flexibility to meet operational and business needs. Occasional evening, early morning, or after-hours support may be required to respond to security incidents, investigations, and other time-sensitive matters.
In Washington, D.C., the expected base salary range for this role is $135,000 to $175,000 per year.
In Baltimore, the expected base salary range for this role is $125,000 to $163,500 per year.
In Denver, the expected base salary range for this role is $123,00 to $161,500 per year.
This range reflects a good-faith estimate of pay at the time of posting; the actual compensation offered may vary depending on factors such as the candidate's qualifications. This position is eligible for additional forms of compensation, which may include annual discretionary bonuses. Employees in this role are also eligible for benefits offered by the firm, subject to applicable plan terms and conditions, which currently include medical, dental, and vision insurance; a 401(k) retirement plan; and paid time off. Please review this link for more information regarding employee benefits in the United States.
This job description sets forth the responsibilities of this position and may be changed from time to time as shall be determined.
