Cyber Incident Commander
135k - 203k USD
On-site
Full Time
#Technology
#Incident Response
#SIEM
#Framework
#Engineering
#Threat Intelligence
#Data
#Management
We are currently seeking a Cyber Incident Commander to join our SOC team out of our Newark, CA headquarters!
You will:
- Lead incident response activities as per Lucid IRP (Incident Response Plan) including scoping, communication, reporting, and long-term remediation planning
- Oversees the collection of intelligence feeds from relevant sources (e.g., commercial, open-source feeds) and direct the integration with security monitoring and security information and event management (SIEM) systems
- Receive and Respond to Cyber Security Alerts and Security Incident Reports
- Actively call and lead security incident bridges and coordinate internal incident response efforts between First Responders, operations teams, and managed security services
- Coordinate investigation, containment, and other response activities with business stakeholders and groups
- Ensure detailed incident report documentation aligned to the IRP as required and ticketing
- Develop incident analysis and findings reports for management, including gap identification and recommendations for improvement
- Research, develop, and enhance content within SIEM, EDR, UEBA and other tools
- Enhance and maintain organization-wide cybersecurity monitoring capabilities, including logging, reviewing, and responding to alerts/issues
- Manages, reviews, and disseminates threat intelligence reports as requested
- Coordinates with relevant teams (e.g., Legal) to drive compliance with applicable regulatory requirements for security incidents
You bring:
- 5-7 years of experience leading information security incident response and coordinating incident response for critical cyber events
- Strong working knowledge of MITRE Framework and ability to profile threat actor attack patterns
- 5-7 years of collaborating with IT and Engineering stakeholders to drive incident response and remediation
- Experience with SOC engineering for SIEM, CTI tools and EDR
- Experience presenting incident strategy to an executive audience
- 5-7 years of working with security tools such as SIEM, Analytics & Intelligence, Firewall/IDS/IPS, Intrusion Detection, Malware detection, Data Loss Protection, and Identity & Access Management
- Ability to stay up to date on current cyber threat landscape, cyber threat trends, threat actors/groups, and exploit campaigns
- Maintain incident management program documentation, including incident response runbooks
Nice to Have:
- Experience working with a major cloud based or on-prem SIEM
- Automobile and/or manufacturing industry experience is a plus
- Leadership skills—the ability to take command in a high-stress situations
By Submitting your application, you understand and agree that your personal data will be processed in accordance with our Candidate Privacy Notice. If you are a California resident, please refer to our California Candidate Privacy Notice.










