Sr. Staff Security Analyst- Incident Commander

Senior Staff Security Analyst – Incident CommanderAt UKG, the work you do matters. The code you ship, the decisions you make, and the care you show a customer all add up to real impact. Today, tens of millions of workers start and end their days with our workforce operating platform. Helping people get paid, grow in their careers, and shape the future of their industries. That's what we do.We never stop learning. We never stop challenging the norm. We push for better, and we celebrate the wins along the way. Here, you'll get flexibility that's real, benefits you can count on, and a team that succeeds together. Because at UKG, your work matters-and so do you.As a Senior Staff Security Analyst – Incident Commander, you will be part of UKG's Global Security Operations team. This global team is responsible for detecting, investigating, responding to, and leading containment of sophisticated cyber threats and major security incidents. In your role you will leverage a variety of tools, forensic techniques, threat hunting methods, and incident command practices to proactively investigate, respond to, and drive resolution for emerging and/or persistent threats impacting UKG and/or its customers.Responsibilities:Provide hands-on digital forensics and incident response expertise across endpoint disk, memory, network, cloud, Windows, Linux, and runtime environmentsLead major cyber incident command activities, including coordinating technical response, guiding investigative workstreams, tracking actions, briefing stakeholders, and driving incidents through containment and recoveryPerform hands-on keyboard threat hunting with and without GenAI assistance across SIEM, EDR, cloud, identity, network, and forensic data sourcesSupport and lead complex incident response investigations as a technical contributor and collaborator across Security Operations Center, Threat Intelligence, Detection Engineering, Cloud Security, Infrastructure, Legal, Privacy, and business stakeholder teamsGuide, mentor, and train analysts during active incidents, post-incident reviews, tabletop exercises, and proactive hunting engagementsCreate and present incident strategies, investigation plans, findings, timelines, and technical summaries to audiences of technical and executive leadership levels when askedDevelop and maintain training materials, playbooks, procedures, and practical exercises for incident command, digital forensics, incident response, and threat hunting capabilitiesUse mid-level scripting and automation to accelerate investigations, enrich forensic analysis, standardize response actions, and improve repeatability across the SOCSupport continuous improvement of incident handling processes, forensic collection methods, threat hunting tradecraft, and analyst readinessPartner with Detection Engineering and Threat Intelligence teams to convert investigative findings into durable detections, response logic, hunting hypotheses, and operational improvementsSupport reverse engineering or malware analysis activities when needed, including triage of suspicious binaries, scripts, payloads, and attacker tooling where skillsets applyQualifications:The ability to lead complex security incidents, guide technical teams, influence response direction, and support building strategic and technical SOC initiatives5+ years of direct hands-on digital forensics and incident response experience supporting major enterprise environmentsAdvanced knowledge of forensic artifact areas across network, cloud, Windows, Linux, endpoint, identity, and runtime environmentsDemonstrated experience leading or supporting major cyber incident command, including technical coordination, action tracking, decision support, stakeholder updates, and post-incident improvement activitiesDeep hands-on experience performing endpoint disk, memory, cloud, and host-based forensic analysis in active incident response scenariosDemonstrated hands-on threat hunting experience using SIEM, EDR, cloud telemetry, identity logs, network data, and forensic artifactsExperience applying GenAI-assisted workflows to investigation, summarization, hunt development, scripting, or analyst enablement, while maintaining strong technical validation and judgmentAbility to lead, mentor, train, and influence technical analysts during investigations, hunting activities, and operational readiness effortsDemonstratable hands-on skills in a scripting language such as Python, PowerShell, Bash, or similar for use in investigation, automation, parsing, enrichment, and response workflowsStrong understanding of SOC operations, incident response lifecycle, forensic collection standards, evidence handling, investigation documentation, and executive-ready incident reportingAbility to develop practical training content for incident command, digital forensics, incident response, and threat hunting programsExperience with one or more major public cloud service provider environment requiredReverse engineering and malware analysis experience preferred, including static or dynamic triage of malware, scripts, payloads, or attacker toolingHands-on keyboard investigative analysis experience with one or more major SIEM, EDR, SOAR, cloud security, case management, and forensic tooling platformsUKG is the Workforce Operating Platform that puts workforce understanding to work. With the world's largest collection of workforce insights, and people-first AI, our ability to reveal unseen ways to build trust, amplify productivity, and empower talent, is unmatched. It's this expertise that equips our customers with the intelligence to solve any challenge in any industry – because great organizations know their workforce is their competitive edge. Learn more at ukg.com.Equal Opportunity EmployerUKG is an equal opportunity employer. We evaluate qualified applicants without regard to race, color, disability, religion, sex, age, national origin, veteran status, genetic information, and other legally protected categories. Arizona Staffing