Incident Response Analyst

About the role

The Staff Incident Response Analyst is a senior individual contributor within Orbia's Cyber Incident Response Team, responsible for leading complex security incidents and building the processes, automation, and metrics that enhance the organization’s overall incident response capability.

Key responsibilities

• Lead Orbia's most complex and high‑impact security incidents, coordinating response across internal teams, service providers, and business stakeholders.
• Design, maintain, and continuously improve incident response playbooks, runbooks, decision trees, and escalation procedures for critical incident types.
• Build and mature automation and orchestration capabilities, including evidence‑collection workflows, enrichment pipelines, and repeatable containment patterns.
• Drive proactive threat hunting and validate detection coverage using threat intelligence, behavioral analytics, and data from Orbia's detection stack.
• Define, track, and report operational metrics such as time to detect, contain, and recover, using results to prioritize improvements.

Required profile

• Bachelor's degree in Cybersecurity, Computer Science, Engineering or related field (Master's preferred).
• 8‑12 years of experience in incident response, digital forensics, security operations, threat hunting or cyber defense engineering.
• Proven experience leading high‑severity incidents and serving as a senior escalation point.
• Ability to influence cross‑functional stakeholders in a matrixed environment without formal authority.

Required skills

• Strong knowledge of enterprise security platforms: SIEM, EDR/XDR, SOAR, email security, DNS security, identity telemetry, network security tools, forensic collection and analysis tools.
• Hands‑on experience with threat‑actor frameworks such as MITRE ATT&CK and incident response models like NIST SP 800‑61.
• Scripting/automation proficiency in Python, PowerShell or similar languages.
• Experience building playbooks, automation, tooling integration, readiness exercises, and metrics programs.