Cyber Defense Incident Responder

About the role

EY's Cyber & Investigative Services (CIS) is looking for a Senior Cyber Incident Response Coordinator. The role coordinates incident response to cybersecurity events or incidents stemming from suspected threats on a global scale, using exemplary incident management techniques. It requires strong incident response knowledge, global relationship-building, and excellent verbal and written communication.

Key responsibilities

• Coordinate response to cybersecurity incidents caused by external threats, which may involve non-traditional working hours
• Serve as liaison and relationship manager with businesses, other Information Security teams, business partners, management, vendors and external parties
• Maintain relationships with General Counsel, Data Privacy/Protection and Risk Management contacts
• Integrate with other corporate incident management programs and drive process and documentation development
• Develop and document processes for consistent, scalable response and continuous improvement of the global incident response plan
• Review team performance with the Cyber Incident Response lead and set improvement programs
• Draft communications and report updates to leadership during and after incidents
• Own and manage the team's internal action playbooks and knowledgebase

Required profile

• Bachelor's or Master's degree in Computer Science, Information Systems, Engineering or a related field, or equivalent experience
• 7+ years' experience in at least two of: SOC Analyst/Manager (3 years minimum), Cybersecurity Incident Coordinator, Cybersecurity Threat Intelligence, Cybersecurity Detection Engineering, Attack & Penetration Testing, eDiscovery or other cyber defense functions
• On-call availability off hours in rotation with other team members (required)
• Willingness to pursue certifications such as GCFE, GCFA, GCIH, CISA, CISM, CISSP or CCIM

Required skills

• Incident response lifecycle, chain-of-custody, forensics and digital forensics
• SIEM tools (e.g. Splunk, Sentinel)
• Windows and Unix/Linux operating systems
• Log correlation and analysis, malware identification and analysis
• Basic understanding of electronic discovery and incident reporting regulations