Cybersecurity Incident Responder

Serve as a primary CSIRT escalation point, commanding investigation, analysis, containment, and remediation of confirmed cybersecurity incidents across the global enterprise. Lead responses using established playbooks and service-level targets, performing advanced analysis across endpoint, network, identity, email, cloud, applications, and logs. Use SIEM/SOAR, EDR, and other monitoring tools, document cases in a case management system, and drive continuous improvements to alert quality, runbooks, and incident response capabilities.