Lead Service Manager - Incident Response Analyst

OPENTEXT - THE INFORMATION COMPANYOpenText is a global leader in information management, where innovation, creativity, and collaboration are the key components of our corporate culture. As a member of our team, you will have the opportunity to partner with the most highly regarded companies in the world, tackle complex issues, and contribute to projects that shape the future of digital transformation.AI-First. Future-Driven. Human-Centered.At OpenText, AI is at the heart of everything we do—powering innovation, transforming work, and empowering digital knowledge workers. We are hiring talent AI can't replace to help us shape the future of information management. Join us.As a global leader in secure information management, OpenText empowers businesses to stay ahead of the ever-evolving cyber threats. Our Cybersecurity Enterprise portfolio is formidable, offering innovative solutions that safeguard organizations from malicious attacks, data breaches, and cyber vulnerabilities. By joining our team, you'll be at the forefront of developing and implementing state-of-the-art security technologies, protecting critical assets and sensitive information for clients worldwide.Your ImpactThe Lead Service Manager is a senior technical practitioner within the MSS SOC and CSIRT function, responsible for leading and delivering incident response engagements across the organization’s multi-tenant managed security client base. This role provides dedicated capacity for the Incident Response retainer service, ensuring clients receive rapid, expert-led containment, investigation, and remediation when security incidents occur.Operating within an MSS environment serving SMB clients, the Senior IR Analyst works alongside the existing CSIRT and DFIR capability to ensure retainer commitments are met without degrading day-to-day detection and response operations. The role demands a practitioner who can operate independently under pressure, communicate clearly with client stakeholders, and contribute to the continuous improvement of the MSS incident response capability.This role is critical to maintaining client trust and delivering high-confidence incident response outcomes across the MSS portfolio.As a Lead Service Manager, you will:Lead Incident Response (IR) retainer engagements, directing containment, eradication, recovery, and incident triage activities across client environments.Investigate security incidents including ransomware, BEC, data exfiltration, insider threats, and APTs through remote and on-site response engagements.Coordinate incident response efforts with client IT teams, legal counsel, insurers, regulators, and stakeholders in accordance with MSOD requirements.Deliver professional incident reports, root cause analyses, and post-incident review (PIR) documentation.Maintain chain-of-custody procedures for digital evidence and support forensic investigations with legal or regulatory implications.Perform digital forensic investigations across Windows, Linux, macOS, Microsoft 365, Azure AD/Entra ID, AWS, and Google Workspace environments.Analyze memory, disk, log, network, and cloud audit data to determine incident scope, impact, root cause, and develop IOCs.Utilize EDR tools and threat-hunting techniques to identify adversary activity, trace lateral movement, and support containment decisions.Serve as an escalation point for SOC analysts, providing mentorship, investigation guidance, and contributing to IR playbooks, runbooks, TTX, and purple team exercises.Communicate incident status, impacts, PIR findings, and strategic recommendations effectively to both technical and executive stakeholders.What you need to Succeed:5+ years of progressive cybersecurity experience, including 3+ years in hands-on Incident Response (IR), DFIR, or senior SOC analyst roles.Proven experience leading incidents through the full IR lifecycle, including preparation, detection, analysis, containment, eradication, recovery, and post-incident activities.Hands-on digital forensics expertise across Windows, Linux, macOS, network, and cloud environments.Experience delivering security services within MSSP, SOC, or MDR environments supporting multiple clients concurrently.Strong background producing client-facing incident reports, post-incident reviews, and investigative documentation.Proficiency with SIEM platforms (Devo, Splunk, Sentinel), EDR tools (CrowdStrike, SentinelOne, Defender for Endpoint), and case management systems.Deep knowledge of cyber attack lifecycles, threat actor TTPs, ransomware, BEC, APT, insider threats, and identity-based attack techniques.Expertise in forensic artifact analysis, memory forensics, live-response triage, network forensics, and cloud investigations across Microsoft 365, Azure AD/Entra ID, AWS, and Google Workspace.Scripting and automation skills using Python, PowerShell, or Bash, with familiarity in SIEM/SOAR platforms, automated response playbooks, malware analysis, and chain-of-custody practices.Holds or is actively pursuing industry certifications such as GIAC Certified Incident Handler (GCIH) or GIAC Certified Forensic Analyst (GCFA), with strong communication, leadership, collaboration, and documentation skills.One last thing:OpenText is more than a corporation—it’s a global community built on trust, character, and purpose. Here, we act ethically, care deeply about people, and always put our clients first. We help teams succeed through collaboration, tackle challenges with resilience, and innovate with intention.Join us on our mission to drive positive change through privacy, technology, and teamwork. At OpenText, we don’t just have a culture—we live our values. Choose us because you want to be part of a company that empowers you to make a meaningful impact.OpenText's commitment to diversity and inclusion surpasses legal requirements, evident in our Equal Employment Opportunity Statement of Policy which promotes a respectful and empowering environment for employees of all backgrounds, culture, national origin, race, color, gender, gender identification, sexual orientation, family status, age, veteran status, disability, religion, or other basis protected by applicable laws.If you need assistance and/or a reasonable accommodation due to a disability during the application or recruiting process, please submit a ticket at Ask HR. Our proactive approach fosters collaboration, innovation, and personal growth, enriching OpenText's vibrant workplace.Compensation: At OpenText, we offer a thoughtfully designed benefits package that supports your physical, emotional, and financial wellbeing. As you move through the hiring process, we’re happy to provide more details about our compensation programs, including variable and commission compensation opportunities for eligible roles, vacation entitlement, and paid time off.Salary Range: $86,800.00 - $130,200.00; Depending on the candidate’s education, experience, skills, geographical location, and alignment with internal equity and external market, actual salary may vary and be higher or lower than the range posted.AI Usage Disclosure:As part of our commitment to transparency, we use artificial intelligence (AI) tools to assist in various stages of our recruitment process, including resume screening, candidate matching, interview scheduling, and communications. These tools are designed to improve efficiency, reduce bias, and enhance candidate experience. All decisions regarding hiring are made by qualified human professionals, and we continuously monitor our AI systems to ensure fairness and compliance with applicable regulations.Job SummaryJob number: 52563Date posted : 2026-07-20Profession: EngineeringEmployment type: Regular