Overview
As an Incident Response / DFIR Analyst, you will play a pivotal role within the incident response team at an MSSP, managing incidents across diverse client environments from initial alert to resolution. This hands-on position involves direct client interaction, offering guidance during incidents and ensuring effective communication throughout the process. You will collaborate with various teams such as Security Operations, Professional Services, and Customer Success to enhance the overall incident response service.
Responsibilities
- Triage and investigate alerts from SIEM, EDR/XDR, and other platforms, setting severity and escalating as necessary.
- Lead or support investigations into incidents like phishing, malware, and unauthorized access, coordinating with client stakeholders.
- Communicate effectively with clients during incidents, providing technical guidance and updates.
- Conduct DFIR analyses across various artefacts while maintaining evidence integrity and mapping findings to MITRE ATT&CK.
- Initiate intelligence-led threat hunts and develop detection content to address identified gaps.
- Maintain incident response playbooks and runbooks, and facilitate post-incident reviews and tabletop exercises.
Requirements
- Hands-on experience in DFIR, incident response, or cyber defense.
- Proficiency with SIEM and EDR/XDR tools in incident investigation.
- Strong analytical skills regarding Windows and Linux systems and network security logs.
- Knowledge of the incident response lifecycle and frameworks such as MITRE ATT&CK and NIST.
- Understanding evidence handling and forensic methodologies.
- Ability to communicate clearly under pressure with clients and senior stakeholders.