Cyber Security Analyst

Brooksource is a consulting firm seeking a Senior Incident Responder to join a Cyber Defense Operations team at a major media client. The role involves managing and evolving the incident response program, driving the full incident lifecycle, and collaborating with various teams to ensure robust defenses against cyber threats.

Responsibilities:

• Lead and execute the full lifecycle of incident response, from detection to closure
• Develop and refine detection logic and workflows to proactively identify threats
• Produce clear, formal incident reports and presentations for technical and executive stakeholders
• Manage incident investigations related to vulnerabilities, malware, and emerging threats
• Coordinate across response, detection, and intelligence teams to ensure swift containment and remediation
• Leverage cloud-native tooling for incident investigation and remediation across Azure, AWS, and Google Cloud (including Azure IAM and identity-related investigations)
• Utilize and tune security platforms including Demisto/XSOAR, Splunk, and CrowdStrike
• Collaborate with the CDO tools management lead to enhance automation and orchestration capabilities
• Partner with vulnerability management, PCI compliance, and penetration testing teams as needed
• Present incident findings and threat landscape updates to leadership
• Contribute to the strategic roadmap for incident response tooling and lifecycle processes

Requirements:

• 6–8+ years of hands-on experience in incident response in enterprise environments
• Proven ability to drive incident detection, containment, and remediation efforts independently
• Expertise in writing and delivering professional incident reports and executive presentations
• Familiarity with MITRE ATT&CK framework and applying it to investigations
• Proficiency with cloud-native response tools and workflows across Azure, AWS, and Google Cloud
• Deep hands-on experience with Demisto/XSOAR, Splunk, and CrowdStrike
• Strong knowledge of malware behavior, threat hunting, and vulnerability exploitation methods
• Ability to operate in a hybrid role spanning incident response, threat detection, and threat intelligence
• Values practical, proven experience over certifications
• Certifications such as GCIH, GCFA, GCIA, OSCP (not required)
• Experience in large-scale media, entertainment, or streaming environments
• Familiarity with PCI compliance, penetration testing, and MSSP collaboration