RemoteLeaf Logo
Log in Sign up

Incident Response Program Lead

8 hours, 37 minutes ago
United States
Full-time
Lead
Security Analyst
Cybersecurity
AWS Cloudflare Network Security SIEM
Apply Now
iSeatz

iSeatz

iSeatz powers devotion through cutting-edge travel tech, offering customized booking solutions and loyalty rewards for top brands in travel and finance.

Consumer Services
51-200
Founded 1999
View All Jobs

Description

  • Own and continuously improve the security incident response program, including policies, plans, playbooks, severity classifications, escalation criteria, and documentation.
  • Lead security and compliance incident response activities, including investigation, containment, eradication, recovery, evidence preservation, and post-incident follow-up.
  • Oversee MSSP onboarding, service integration, SLAs, detection coverage, response quality, contractual requirements, and performance metrics.
  • Partner with the MSSP and internal teams to improve alert quality, detection rules, log coverage, threat intelligence, investigation procedures, and response automation.
  • Run MSSP service reviews and track performance deficiencies and corrective actions through resolution.
  • Lead incident-response tabletop exercises and required testing, documenting lessons learned and remediations.
  • Maintain incident readiness through responder training, coverage planning, escalation capabilities, and coordination with internal responders and the MSSP.
  • Report on incident trends, response metrics, recurring issues, control gaps, and MSSP performance.
  • Support risk assessments, compliance and audit activities, policy and control reviews, vendor assessments, and remediation planning.
  • Advise leadership and technical teams on security events, emerging risks, priorities, and business decisions; participate in an on-call rotation as required.

Requirements

  • 5+ years of information security experience, including substantial incident response, security operations, or detection and response experience.
  • Experience leading or coordinating security incidents across technical and business teams throughout the full incident response lifecycle.
  • Experience developing, maintaining, and testing incident response plans, procedures, and playbooks.
  • Experience working with an MSSP, MDR provider, SOC, or other managed security partner.
  • Working knowledge of security monitoring, SIEM, endpoint and cloud security, vulnerability management, IAM, network security, and using logs and evidence to investigate events.
  • Experience securing cloud-based environments, particularly AWS and multi-account cloud architectures.
  • Knowledge of incident response frameworks, including NIST CSF, NIST SP 800-61, and the SANS incident response process.
  • Experience supporting PCI DSS, SOC 2, ISO 27001, or similar security and compliance programs.
  • Strong written and verbal communication skills, including documenting incidents and explaining technical risks to business leaders.
  • Experience leading tabletop exercises with executives, Legal, Compliance, Engineering, and external providers.
  • Preferred: Experience with detection engineering, threat hunting, digital forensics, malware analysis, false-positive reduction, or security automation.
  • Preferred: Hands-on experience with Sumo Logic, AWS security tools, Cloudflare, Lacework, Sophos, or similar technologies.

Benefits

  • Salary range of $146,000–$155,000 USD.
  • Remote-first role available anywhere in the continental United States.
  • Robust health insurance.
  • 401(k) plan with company matching.
  • Generous paid time off.
  • Up to eight weeks of paid parental leave for eligible caregivers.
  • Annual professional development allowance.
  • Flexible, autonomous work environment.

Interested in this position?

Apply directly on the company website

Apply Now

Similar Roles

Saviynt

L3 SOC Analyst

Saviynt 501-1000 Internet Software & Services

Saviynt is hiring a UK-based L3 SOC Analyst to lead advanced investigations, threat detection, and security automation for government-focused cloud and hybrid environments.

United Kingdom Full-time Senior Security Analyst
AWS Bash CrowdStrike Cybersecurity Go Kubernetes PowerShell Python Splunk
5 hours, 52 minutes ago
Skaylink

Security Analyst Tier 2 (m/f/d)

Skaylink 201-500 IT Services

Join Skaylink, part of Vodafone, as a SOC Analyst to investigate security incidents, strengthen threat detection, and protect customer environments in a modern SOC.

Romania Full-time Mid Level Security Analyst
Cybersecurity PowerShell Python SIEM
14 hours, 52 minutes ago
Bounteous

VP, Delivery

Bounteous 1001-5000 Internet Software & Services

Bounteous is seeking a Vice President of Digital Delivery to lead the strategy, execution, quality, and economics of a North American portfolio of complex digital, platform, and AI-enabled client programs.

United States Full-time Executive Program Manager
$157k-$227k
Agile AWS Azure Confluence GCP JIRA Salesforce Scrum
5 hours, 37 minutes ago
Bounteous

Technical Director

Bounteous 1001-5000 Internet Software & Services

Bounteous is seeking a Tech Delivery Leader to lead client-facing, end-to-end delivery and account growth for complex AI-driven enterprise engagements.

United States Full-time Executive Program Manager
5 hours, 37 minutes ago

You're on a roll! Sign up now to keep applying.

Sign Up

Already have an account? Log in

Used by 14,729+ remote workers