- Lead incident response, containment and forensic coordination for confirmed security incidents.
- Act as Incident Commander for major incidents and assign roles and ownership for investigation, containment and recovery.
- Maintain incident timelines, evidence logs, decision logs and action tracking.
- Coordinate investigations across endpoints, servers, identities, cloud platforms, SaaS environments and network telemetry.
- Direct forensic collection and analysis to determine attack path, scope, persistence and impact.
- Coordinate containment, eradication and recovery actions with technical owners and ensure systems return to a sufficiently trusted state.
- Preserve relevant evidence and maintain forensic and evidence-handling standards.
- Lead post-incident reviews and ensure remediation actions have owners, due dates and follow-up.
- Develop incident playbooks, forensic checklists and containment procedures; identify telemetry and forensic-readiness gaps.
- Develop and mentor Incident Response / DFIR Specialists and provide incident updates to leadership and stakeholders.
Linux