Incident Response Lead, Cyber Security

Security operations assessment

Independently evaluate how security operations teams detect, investigate, contain, and respond to threats. Assignments draw on practical incident experience and produce structured recommendations for improvement.

• Examine alert pipelines, triage processes, and escalation routes for consistent quality.
• Assess whether response actions are complete and effective across actual or simulated incident timelines.
• Identify missing logs, weaknesses in detection logic, and gaps in containment procedures.
• Check playbooks for correctness, clarity, and feasibility in operations.
• Summarize recurring incident patterns and operational bottlenecks.
• Support continuing reviews of SOC maturity and readiness, with analytical documentation of findings.

Required experience

Hands-on SOC work, incident response leadership, or cybersecurity operations experience is essential. You need strong knowledge of detection engineering, response processes, and the full incident lifecycle.

The role requires sound analysis and clear written assessments. You should consistently deliver careful evaluations while working independently.

Useful background

Familiarity with SIEM tools such as Splunk, Sentinel, or Chronicle is helpful. EDR, cloud-native detection, threat intelligence, purple teaming, and adversary simulation are also relevant.

GCIH, GCFA, CISSP, or comparable certifications are welcome.

Terms

The hourly contract is fully remote and flexible, with structured assessments across varied SOC environments, tools, and operational challenges. Further engagements or contract extension may be available.