Principal Lead Analyst, Detection & Response Team (DART)

About The Role As the Principal Lead Analyst of DART, you are the ultimate technical authority for cyber defense and incident response. This high‑impact leadership role combines elite‑level technical expertise with strategic vision. You will oversee the most complex security breaches, drive the evolution of our threat‑hunting program, and mentor the next generation of responders. You are responsible for ensuring that the organization is not just "ready" for a crisis, but resilient enough to withstand one. This role partners closely with Cyber Intelligence, Defense and Response, Application Security, and Cyber Resilience teams, and supports incident response efforts as an expert resource on adversarial capabilities. Responsibilities Strategic Incident Command (Major Incidents): serve as the primary Incident Commander for all Tier 3/Critical‑level events; direct the technical response across all workstreams (Forensics, Network, Cloud, Legal, and PR). Crisis Communication: act as the technical voice for executive leadership; translate complex exploit chains and technical risks into business‑impact narratives for the C‑Suite and Board of Directors. Adversary Emulation: lead "Purple Team" exercises to test DART’s readiness against specific APT groups and real‑world attack scenarios. Advanced Detection & Hunting Strategy: design and oversee the organization’s long‑term threat‑hunting roadmap, ensuring coverage across the MITRE ATT&CK framework for Cloud (Azure/AWS), Identity, and On‑Prem infrastructure. Detection Engineering Oversight: collaborate with engineering teams to ensure that hunt findings are converted into high‑fidelity, automated detections and SOAR workflows. Intelligence Integration: direct the consumption of tactical and strategic Threat Intelligence to proactively harden the environment before a known threat actor targets the industry. Technical Leadership & Mentorship Force Multiplier: elevate the entire SOC/DART capability by providing technical mentorship to L1 and L2 analysts; perform technical QA of the team’s investigative output. Tooling & Innovation: evaluate and select next‑generation forensic and response technologies; drive the business case for new security investments. Post‑Incident Strategy: lead the "Lessons Learned" process for major incidents, ensuring that root causes result in fundamental shifts in the enterprise security posture. Skills and Qualifications 8+ years in Cybersecurity, with at least 5 years in a dedicated Incident Response or DFIR role. Proven experience leading response efforts for a large‑scale enterprise or a top‑tier IR firm (e.g., Mandiant, CrowdStrike). Solid understanding of deep‑system forensics (Memory, Disk, Network) and specialized experience in Cloud IR (Azure/AWS/O365). Deep familiarity with enterprise forensic platforms (Nuix, Magnet AXIOM, EnCase) and the ability to guide L2 analysts. Expert‑level understanding of TTPs used by both state‑sponsored and financially motivated threat actors. High proficiency in automation (Python, PowerShell) to build custom response scripts or API integrations between security tools. Preferred certifications: GCFA, GNFA, GREM, or GXPN. Leadership certifications: CISSP‑ISSMP or GCIH. Decisiveness, political acumen, and resilience under high‑stress, 24/7 incident cycles. Compensation The anticipated salary range for this position is $168,000 to $195,000 at the commencement of employment for the Jersey City, NJ and Woodland Hills, CA area. Compensation will vary based on location, skills, experience and other qualifications. The position is eligible for a discretionary bonus in accordance with the applicable incentive plan. Work Location This position is based in Corebridge Financial’s Woodland Hills, CA, Jersey City, NJ, or Houston, TX office and is subject to our hybrid working policy. Estimated travel may include up to 25%. Benefits Health and Wellness: medical, dental, vision insurance plans, and mental health support. Retirement Savings: competitive 401(k) plan with dollar‑for‑dollar contributions of up to 6% employee match. Employee Assistance Program: confidential counseling services. Matching charitable donations: up to 1:1 matching up to $5,000. Volunteer Time Off: up to 16 hours annually. Paid Time Off: at least 24 PTO days. Equal Opportunity Employer Corebridge Financial is an equal opportunity employer. All applicants will be considered for employment based on job‑related qualifications and without regard to race, color, religion, sex, gender identity or expression, sexual orientation, national origin, disability, neurodivergence, age, veteran status, or any other protected characteristic. The company is also committed to compliance with all fair employment practices regarding citizenship and immigration status. Corebridge Financial is committed to providing reasonable accommodations to job applicants and employees, including any accommodations needed on the basis of physical or mental disabilities or sincerely held religious beliefs. If you need a reasonable accommodation, please send an email to View email address on click.appcast.io. We will consider for employment qualified applicants with criminal histories, consistent with applicable law. #J-18808-Ljbffr