Information Technology Manager II

• Lead complex cyber incident investigations across enterprise, cloud, hybrid, and on-premises environments • Conduct end-to-end incident response, including triage, scoping, containment, eradication, recovery, and post-incident reporting • Investigate network intrusions, account compromise, ransomware, insider risk, fraud-related incidents, unauthorized access, and advanced threat activity • Preserve evidence and maintain chain of custody for forensic, legal, compliance, and regulatory investigations • Produce investigative findings, root cause analyses, executive summaries, and remediation recommendations • Perform digital forensics and incident response across Windows, cloud, identity, endpoint, network, and application environments • Conduct dead-box forensic examinations, artifact analysis, timeline analysis, and evidence collection • Analyze suspicious files, malware behavior, persistence mechanisms, attacker tooling, and indicators of compromise • Conduct proactive threat hunting and improve SIEM detections, correlation rules, KQL queries, alerts, dashboards, and response workflows • Apply MITRE ATT&CK, threat intelligence, incident lessons learned, and attacker TTPs to improve detection coverage • Partner with SOC, Threat Intelligence, Engineering, Platform, Infrastructure, Cloud, Identity, Application, and Security Operations teams • Support engineering, administration, optimization, log onboarding, data normalization, telemetry validation, and use-case development for security platforms • Build scripts, queries, automation, dashboards, and technical workflows to improve investigation speed and quality • Use AI-assisted tools, copilots, automation, and scripting to improve investigation efficiency, reporting, and analysis • Support threat emulation and purple team activities and assist with attack path, lateral movement, persistence, and detection validation analysis • Serve as senior technical lead during significant cybersecurity investigations and incident response efforts • Mentor SOC Leads, Security Analysts, Incident Responders, and Security Engineers • Contribute to playbooks, runbooks, investigation standards, threat hunting procedures, and operational documentation • Communicate with technical teams, leadership, Legal, HR, Compliance, and business stakeholders Requirements 5–10+ years of experience in Cyber Security, Incident Response, DFIR, Threat Hunting, Detection Engineering, Security Operations, or related disciplines Proven experience leading enterprise-level cyber incident response investigations Hands-on experience with digital forensic analysis, evidence collection, malware analysis, and investigative reporting Experience across cloud, hybrid, identity, endpoint, network, and on-premises enterprise environments Experience developing detections, automations, playbooks, scripts, queries, or engineering solutions that improve security outcomes Strong understanding of Microsoft Entra ID, Active Directory, Azure, Microsoft 365, identity security, and enterprise authentication concepts Strong understanding of Windows operating systems, endpoint telemetry, authentication logs, forensic artifacts, and persistence mechanisms Knowledge of cloud security across Azure, AWS, GCP, SaaS, identity, logging, and monitoring environments Knowledge of incident response frameworks, cyber kill chain, MITRE ATT&CK, threat intelligence, and threat-informed defense Knowledge of enterprise security operations, including SIEM, EDR, NDR, SOAR, vulnerability data, network security, and email security Hands-on experience with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, or equivalent Hands-on experience with EDR/XDR platforms such as Microsoft Defender XDR, Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, or equivalent Experience with digital forensic tools, forensic imaging, artifact collection, timeline analysis, endpoint investigation, and evidence handling Scripting, querying, and automation using PowerShell, Python, Kusto Query Language, SQL, APIs, or equivalent Experience with detection engineering, threat hunting, malware triage, alert tuning, dashboards, correlation rules, and response workflows Experience performing artifact-based investigations across endpoint, identity, email, cloud, and network data sources Ability to analyze phishing, credential theft, lateral movement, privilege escalation, command execution, and data access Experience producing forensic timelines, investigative findings, executive summaries, and remediation recommendations Ability to operate independently during urgent or high-impact incidents while maintaining accuracy, documentation, and evidence integrity Bachelor’s degree in Cyber Security, Computer Science, Information Technology, Digital Forensics, or related field is preferred; equivalent experience considered Ability to travel to an Arrow office location as requested by Arrow leadership Preferred certifications include GCFA, GCFE, GCIH, GCIA, GREM, GCFR, GNFA, GCTI, OSCP, CEH, CISSP, Microsoft Security Operations Analyst, Microsoft Cybersecurity Architect, or other relevant certifications Core Competencies Demonstrates expertise in leading complex cyber incident investigations and incident response across diverse environments, including cloud and on-premises. Proficient in digital forensics, threat hunting, and developing security automations to enhance incident detection and response. Highest-signal resume keywords Cyber Incident Response Digital Forensics Threat Hunting SIEM Platforms Scripting and Automation ATS Optimization Keywords Hard Skills Digital Forensic Analysis Malware Analysis Incident Response Frameworks Detection Engineering Artifact Collection Timeline Analysis Kusto Query Language PowerShell Python SQL Soft Skills Leadership Communication Mentoring Problem-Solving Collaboration Certifications & Qualifications GCFA GCFE GCIH GCIA GREM GCFR GNFA GCTI OSCP CISSP Industry Keywords Cyber Security Incident Response DFIR Threat Intelligence Security Operations Enterprise Security Compliance Regulatory Investigations Advanced Threat Activity Evidence Integrity Tools & Technologies Microsoft Sentinel Splunk QRadar Microsoft Defender XDR CrowdStrike SentinelOne Azure AWS GCP Microsoft 365 #J-18808-Ljbffr