Staff Incident Response Analyst

About the role

The Staff Incident Response Analyst is a staff-level individual contributor within Orbia's Cyber Incident Response Team (CIRT). The role shapes how the organization prepares for, investigates, contains and recovers from cybersecurity incidents at global scale, leading the most complex and high-impact incidents while building the playbooks, automation, metrics and readiness frameworks that strengthen the wider incident response function.

Key responsibilities

• Lead the most complex and high-impact security incidents as a senior technical escalation point, coordinating response across internal teams, service providers and business stakeholders.
• Design, maintain and improve incident response playbooks, runbooks, decision trees and escalation procedures for critical incident types.
• Build and mature incident response automation and orchestration, including evidence collection workflows, enrichment pipelines, containment patterns and case-management improvements.
• Lead cross-organizational readiness activities such as tabletop exercises, pre-staged response kits and business-unit escalation readiness.
• Drive proactive threat hunting and validate detection and control coverage against emerging threats using threat intelligence, behavioral analytics and detection-stack data.
• Shape the incident response tooling strategy by evaluating integrations, finding capability gaps and partnering with engineering teams and vendors.
• Define, track and report metrics such as time to detect, time to contain, time to recover, case quality and exercise outcomes.
• Partner with Legal and Compliance, Security Architecture and Engineering, Cyber Threat Operations and IT leaders on evidence handling, forensic support and remediation.
• Lead post-incident reviews and root-cause analysis, turning findings into improvements in detection logic, procedures, controls and resilience.

Required profile

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering or a related field, or equivalent hands-on experience; a Master's degree is desirable.
• Fluent English, written and verbal.
• 8 to 12 years of experience in incident response, digital forensics, security operations, cyber threat hunting, cyber threat intelligence or cyber defense engineering.
• Demonstrated experience leading complex, high-severity incidents and acting as a senior escalation point.
• Experience building incident response capabilities beyond case handling, including playbooks, automation, tooling integration, readiness exercises or metrics programs.
• Experience influencing IT, security engineering, legal, compliance and business stakeholders in a matrixed enterprise without formal authority.

Required skills

• Incident management lifecycle, containment strategy, evidence handling, forensic support and root-cause analysis.
• Enterprise security platforms: SIEM, EDR/XDR, SOAR, email security, DNS security, identity telemetry, network security tooling and forensic collection tools.
• Threat actor TTPs, MITRE ATT&CK and NIST SP 800-61.
• Scripting or automation in Python, PowerShell or similar.