Incident Response Engagement-Lead

Accountabilities:: Lead and coordinate the full incident response lifecycle, including scoping, containment, eradication, and recovery, across moderately complex, multi-system environments. Serve as the primary point of contact for claims teams, breach counsel, incident response providers, and policyholders throughout active cyber incident engagements. Manage and oversee digital forensics and incident response providers, ensuring investigations are appropriately scoped, timely, accurate, and aligned with engagement objectives. Identify, track, and actively manage scope changes and potential scope creep across multiple concurrent engagements while maintaining timelines and stakeholder alignment. Schedule, coordinate, and facilitate briefings on complex forensic findings, translating technical investigation results into clear and actionable reporting for technical, legal, and executive audiences. Work effectively within legally sensitive investigations, applying an understanding of Attorney-Client Privilege and Work Product Doctrine in coordination with legal counsel. Collaborate with claims adjusters, underwriters, external partners, and other stakeholders to support accurate incident documentation and informed coverage determinations. Contribute to the ongoing development and improvement of incident response methodologies, playbooks, processes, and tooling. Requirements: 4–6 years of hands-on experience in digital forensics and incident response (DFIR), with meaningful exposure to the cyber insurance ecosystem, including experience working with or on behalf of insurance carriers, breach counsel, and/or policyholders. Demonstrated experience managing cyber incidents through scoping, containment, eradication, and recovery. Proven ability to lead moderately complex, multi-system investigations while applying strong project management skills and proactively controlling scope. Experience working in legally sensitive environments, with an understanding of Attorney-Client Privilege and the Work Product Doctrine. Strong consulting, communication, and stakeholder management skills, including the ability to present forensic findings to technical, legal, and executive audiences. Ability to remain organized, decisive, and detail-oriented while managing multiple concurrent engagements in high-pressure incident response situations. A bachelor’s degree in Cybersecurity, Information Security Management, Digital Forensics, Computer Science, or a related discipline is preferred. Equivalent professional experience may be considered in lieu of a degree, particularly when combined with relevant industry certifications such as GCIH, GNFA, CompTIA CySA+, CISM, or CISSP. Strong analytical, problem-solving, written communication, and presentation skills, with the ability to translate complex technical information into practical recommendations. Benefits: Remote work opportunity within the United States. Competitive compensation aligned with experience and responsibilities. Comprehensive employee benefits, including healthcare coverage. A collaborative and dynamic environment with opportunities to work across technical, legal, claims, underwriting, and external partner teams. Opportunities for continuous professional development and career growth. The opportunity to work on complex, high-impact cyber incidents and contribute to the evolution of incident response practices. An inclusive workplace committed to equal employment opportunity and a diverse range of perspectives. Exposure to an innovative, technology-driven environment focused on cyber risk, resilience, and incident response.