Incident Responder

About the Role

SOClogix is seeking an experienced Incident Responder to lead and execute cybersecurity incident investigations for our managed security clients. You'll be the frontline defender when a breach occurs - conducting triage, containment, eradication, and recovery operations while coordinating with client IT teams and, when necessary, law enforcement. This is a high-impact role that requires composure under pressure, deep technical skills, and the ability to communicate clearly with both technical staff and executive stakeholders.

What You'll Do

• Lead incident response engagements from initial triage through full remediation and post-incident review
• Perform digital forensic analysis across endpoints, servers, cloud environments, and network infrastructure
• Conduct malware analysis, memory forensics, and log analysis to determine scope, root cause, and impact
• Contain active threats including ransomware, business email compromise, data exfiltration, and insider threats
• Develop and deliver incident reports with timelines, technical findings, executive summaries, and remediation recommendations
• Coordinate with client IT teams, legal counsel, insurance carriers, and law enforcement as needed
• Build and maintain incident response playbooks, runbooks, and escalation procedures
• Conduct post-incident lessons learned and help clients strengthen their security posture
• Participate in on-call rotation for emergency incident response (24/7 coverage)

Requirements

• 3+ years of experience in incident response, digital forensics, or security operations
• Hands-on experience with forensic tools: Velociraptor, KAPE, FTK, Autopsy, X-Ways, or similar
• Strong knowledge of Windows and Linux forensic artifacts (event logs, registry, prefetch, $MFT, syslog)
• Experience investigating ransomware incidents, BEC, lateral movement, and data exfiltration
• Proficiency with SIEM platforms (OpenSearch, Splunk, Sentinel, or similar) and EDR tools (LimaCharlie, CrowdStrike, SentinelOne)
• Understanding of MITRE ATT&CK framework and how to apply it to real-world investigations
• Strong written and verbal communication skills - ability to brief executives and write professional reports
• At least one relevant certification: GCIH, GCFA, GCFE, GREM, EnCE, or equivalent

Nice to Have

• GCFA, GNFA, or GREM certification
• Experience with cloud incident response (Azure AD, M365, AWS CloudTrail)
• Malware reverse engineering skills
• Experience working with cyber insurance carriers and breach coaches
• Scripting skills (Python, PowerShell) for automation and custom tooling
• Previous MSSP or consulting IR experience

Benefits

• Competitive salary based on experience
• Health, dental, and vision insurance
• 401(k) with company match
• Unlimited PTO
• Annual certification and training budget
• Remote-first culture with flexible scheduling
• Paid on-call compensation
• Access to forensic lab and investigation tools