Incident Response Analyst Team Lead

Thrive

Thrive is a leading provider of outsourced IT infrastructure. Our managed services provide customers with a strategic advantage as they secure, scale, and succeed.

Thrive is a rapidly growing technology solutions provider focusing upon Cloud, Cyber Security, Networking, Disaster Recovery and Managed Services. Our corporate culture, engineering talent, customer-centric approach, and focus upon “next generation” services help us stand out amongst our peers. Thrive is on the look-out for individuals who don’t view their weekdays spent at “a job” but rather look to develop valuable skills that ignite their passion and lead to a CAREER. If you’re attracted to a “work hard, play hard” environment, seeking the guidance, training and experience necessary to build a lucrative career, then welcome to THRIVE!!

Position Overview

With a growing client base, Thrive is expanding its security team. We are looking for an experienced Incident Response Analyst Team Lead to join our Cyber Security Incident Response Team. This pivotal role involves leading incident response efforts, mentoring analysts, and continuously improving our customers' security posture by preventing, detecting, analyzing, and responding to cybersecurity incidents using cutting-edge technology and robust processes.

The ideal candidate will bring a blend of leadership, deep technical expertise, and a passion for incident response and forensics. They will play a key role in handling high-priority incidents, refining incident response processes, and mentoring team members to ensure operational excellence.

Primary Responsibilities

1. Provide mentorship, coaching, and guidance to SOC Analysts and Incident Response Analyst
2. Foster collaboration across teams to enhance threat intelligence sharing and operational efficiency
3. Act as a point of escalation for complex investigations and high-priority incidents
4. Lead incident response and threat hunting efforts for confirmed high-priority security incidents, ensuring resolution and documentation
5. Investigate intrusion attempts, differentiate false positives from actual threats, and perform in-depth analysis of exploits
6. Proactively monitor and respond to emerging threats using advanced tools and methodologies
7. Conduct forensic analysis, including memory and disk imaging, to identify evidence of compromise and attacker activity
8. Collect, preserve, and analyze digital evidence to support investigations and potential legal actions
9. Utilize forensic tools to uncover artifacts such as deleted files, malware remnants, and network traces
10. Develop and maintain incident response playbooks, ensuring alignment with the overall security strategy
11. Conduct regular reviews and updates of playbooks to address evolving threats and technologies
12. Participate in tabletop exercises to validate and refine playbooks and incident response procedures
13. Analyze SOC, SIEM, and EDR platform data to identify and escalate potential threats.
14. Collaborate with cross-functional teams to implement security best practices for internal and external clients
15. Ensure adherence to Thrive’s security standards while recommending future enhancements to tools and workflows
16. Utilize threat intelligence to identify potential security risks and proactively mitigate them
17. Stay current on emerging threats, vulnerabilities, and adversarial tactics, techniques, and procedures (TTPs)

Qualifications

Required Skills and Experience

1. Demonstrated experience in incident handling, escalation management, or leading high-priority incident investigations
2. Demonstrated expertise in best security practices and incident response methodologies.
3. Advanced knowledge of:
4. Security Information and Event Management (SIEM) tools
5. Networking (TCP/IP, routing, and switching)
6. IDS/IPS, penetration testing, and vulnerability assessments
7. Windows, UNIX, and Linux operating systems
8. Network protocols and packet analysis tools
9. Endpoint Detection and Response (EDR), antivirus, and anti-malware tools
10. Content filtering and email/web gateways
11. Hands-on experience in forensics, malware analysis, and intrusion detection
12. Familiarity with industry frameworks such as MITRE ATT&CK and the Cyber Kill Chain
13. Proven ability to communicate complex security issues to clients, peers, and management
14. Strong analytical, problem-solving, and decision-making skills
15. Adaptability to rapidly evolving situations and technologies
16. Ability to participate in an on-call rotation for high-priority incidents

Preferred Skills

1. Knowledge of common system calls and APIs for Windows and Linux/Unix environments
2. Experience with programming languages relevant to security analysis and automation
3. Understanding of internal file structures commonly associated with malware
4. Experience in detection engineering and creating high-fidelity detection rules
5. Advanced cloud security knowledge and expertise in investigating cloud-based intrusions

Desired Certifications

1. Computer Hacking Forensic Investigator (CHFI)