Cyber Security Analyst

Insight Global is seeking a cybersecurity professional to support its incident response operations. The Lead Cyber Incident Responder (T3) leads detection, investigation, containment, eradication, recovery, incident command, stakeholder communication, governance, reporting, and continuous improvement activities.

Responsibilities:

• Lead and coordinate security incident response operations end-to-end, from initial alert triage through closure
• Maintain situational awareness for any potential or incoming incidents, including the report cyber incident distro, identifying and escalating any potential incident as swiftly as possible, inline with documented processes and procedures
• Validate and prioritize alerts generated by SIEM, EDR, NDR, SOAR, and threat-intel sources, including hunting activities
• Execute deep and meaningful incident investigations, including analysis across endpoints, servers, cloud services, and network telemetry
• Direct containment actions: host isolation, account disablement, network blocks, identity access revocations, emergency control changes
• Ensure eradication and recovery steps are executed cleanly, validated, and documented
• Decide if, when, and how to escalate incidents to senior management, Legal, HR, DPO, Fraud, BCM, or third parties
• Maintain accurate incident timelines, chain-of-evidence discipline, and investigation notes
• Drive the battle rhythm: situation updates, decision points, stakeholder engagement, and evidence-based assessment of impact
• Define incident objectives, assign tasks, and ensure cross-team accountability
• Communicate status and risk clearly to technical teams, senior stakeholders, and executives when required. Technical and non- technical
• Ensure lessons-learned sessions are completed and improvement actions are logged, tracked, and closed
• Work with CTI to enrich investigations, validate IoCs, link activity to adversary behaviour, and drive hunting hypotheses
• Recommend detection improvements to TDO, signature updates, and tuning based on incident findings
• Support tactical hunts and pivoting based on novel attacker techniques observed in incidents
• Critical celebrity vulnerability and purple teaming involvement with the ASM team
• Recommend and request optimization from ACE for IR tooling: EDR, forensic toolkits, log platforms, case management, SOAR playbooks
• Lead the development, maintenance, and continuous improvement of IR runbooks and playbooks
• Identify automation opportunities to reduce manual toil and increase response speed
• Lead IR tabletop exercises, live action drills, simulations and continuous improvement efforts (internal to IR)
• Support wider tabletop exercises (Fusion Cell and ASM), simulations, and purple-team activities to validate readiness
• Produce high-quality incident reports, impact analysis, and executive summaries
• Track IR metrics: MTTD, MTTA, MTTC, containment quality, repeat incident patterns, root-cause themes
• Ensure IR actions align with policy, regulatory requirements, and evidentiary standards
• Provide assurance that security controls performed as expected during incidents; identify deviations and drive remediation
• Ensure end of shift handover is completed and distribute in a timely fashion and to a high standard
• Adhoc fulfillment of Audit requests driven by control testing and analysis- Limited to SOC/monitoring and IR activities only
• Adhoc IR process improvement based on postmortem activities, either driven directly by IR or Fusion Cell