VP Sr Incident Response Analyst

Our client is a leading global bank with a significant US presence, operating across corporate, investment, and commercial banking. Its US cybersecurity function is growing with a security operations team that is advancing their DFIR capabilities.

This is a senior hands-on seat for an investigator who goes beyond the playbook. You'll be the go-to escalation point for complex incidents, set the investigative standard for a team of developing analysts, and have a real voice in how detection and response mature from here.

The Role

You'll lead the team's most complex investigations, from first alert through root cause, containment, and lasting prevention.

Key responsibilities include:

• Leading deep-dive DFIR investigations into incidents with no existing playbook, identifying the artifacts that show what happened, how, and why
• Running proactive threat hunts and validating the bank's ability to detect and respond to adversary TTPs
• Turning investigation findings into new detections, tuned alerts, and updated response playbooks with detection engineering and automation teams
• Acting as senior escalation point for in-house analysts and the MSSP, while coaching junior team members

What We're Looking For

• 5+ years in SOC, CSIRT, or DFIR roles, with deep hands-on incident investigation experience
• Expert knowledge of Windows forensic artifacts (event logs, registry, execution and persistence evidence) and Active Directory attack paths
• Hands-on experience with forensic tooling alongside SIEM and EDR platforms, plus working knowledge of Linux and cloud security
• Clear written and verbal communication, with the judgment to make sound calls independently during live incidents. GCFA, GNFA, or GCIH a plus
• Knowledge of cyber kill chain, MITRE, or other threat frameworks.