Incident Response Analyst

Incident Response Analyst Location: US-TX-Houston Compensation: $95,000 - $120,000 / year Minimum Education: Bachelor’s Job Type: Full Time Jobcode: EC008 Responsibilities Monitor security alerts from SIEM, EDR, IDS/IPS, and network monitoring tools. Analyze malware, phishing attacks, insider threats, and unauthorized access attempts. Respond to security incidents using established playbooks and frameworks. Conduct root cause analysis and implement containment, eradication, and recovery measures. Perform digital forensics and malware analysis to determine the nature and scope of attacks. Identify and extract indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) used by attackers. Collaborate with threat intelligence teams to track adversary behavior and emerging threats. Document incident reports, timelines, and remediation actions. Develop and update incident response playbooks and standard operating procedures (SOPs). Participate in post‑incident reviews to improve security controls and response strategies. Work closely with SOC analysts, security engineers, and IT teams to enhance detection capabilities. Provide incident response training and tabletop exercises to improve team readiness. Assist in automating security response tasks using SOAR tools. Qualifications Education: Bachelor’s degree in Cybersecurity, Computer Science, Information Security, or related field. Experience: 3+ years in incident response, SOC, or cybersecurity investigations. Certifications (Preferred): GCIH, GCFA, CISSP, CEH, OSCP, or equivalent. Hands‑on experience with SIEM (Splunk, QRadar, Sentinel), EDR (CrowdStrike, Carbon Black, Defender), and forensic tools. Strong knowledge of Windows, Linux, and cloud security (AWS, Azure, GCP). Experience with network traffic analysis, threat hunting, and scripting (Python, PowerShell, Bash). Ability to quickly assess and mitigate security incidents. Strong communication skills for writing technical reports and conveying security risks to stakeholders. Work Environment & Schedule May require on‑call availability for critical incidents. Collaboration with SOC teams, IT, and law enforcement (if needed). #J-18808-Ljbffr