Incident Response Lead

About the opportunity

Contentful strives to build a secure and safe service and commits considerable effort and resources to security. Our Security team supports corporate-wide information security management programs and collaborates closely with internal teams. We believe that Security must be anchored by DevOps principles with strong repeatable processes.

We are looking for a committed and driven Staff Security Analyst with experience performing analysis and incident management of information security events, as well as experience contributing directly to the growth of and design of a security program. As a staff security analyst, you will have daily alert investigation and incident response responsibilities, but you will be empowered to proactively drive change to shape and support the growth of our Security program. Candidates should be skilled in detection management and demonstrate knowledge and understanding of common Information Security principles and frameworks, coupled with excellent communications skills and a continuous desire to learn and grow.

You will be expected to work independently, work as a part of a team, and partner with stakeholders throughout the organization to ensure comprehensive risk mitigation while reducing impact to end users throughout the organization.

What to expect?

• Play an active role in scaling operation practices by contributing to team roadmaps.
• Use modern engineering practices to achieve data driven goals.
• Perform daily alert investigation and response in a cloud-native and traditional environment.
• Investigate and lead teams responding to incidents of varying sizes and complexities.
• Facilitate incident training, including table table-top exercises.
• Create processes, documentation, and runbooks to support a growing team.
• Lead and refine detection engineering, including the creation and upkeep of threat detections.
• Collaborate on threat models by incorporating detection use cases into designs.
• Drive continuous improvement across all aspects of threat detection and response.
• Identify systemic issues and collaborate on approaches to address root causes.
• Opportunity to compose high-quality incident and threat reports for executives.
• Provide insights and input on tool selection to help grow our cybersecurity portfolio.
• Ensure all end users receive delightful and informative interactions with Security.

What you need to be successful?

• 6+ years experience in security operations, including alert triage and investigation
• 4+ years conducting large scale incident response activities
• 2+ years leading or coordinating incident response activities 
• Ability to support occasional off-hours incident response efforts
• Expertise in attacker techniques in cloud-native and traditional environments.
• Hands-on experience owning security technologies (e.g., EDR, AntiVirus, etc.)
• Expertise in AWS audit and security services to investigate cloud centric threats
• Expert usage, data onboarding, and data administration within Splunk
• Mastery of investigation methods and capable of handling complex and ambiguous cases
• Practical experience with cross-platform and hybrid environment investigations
• Ability to perform detailed host analysis on Mac, Windows, & Linux systems
• Proficient in correlating patterns across assets and environments to support investigation.
• Incident lifecycle master with ability to cohesively manage simultaneous workstreams
• Ability to make tactical and fundamental recommendations to improve security
• Ability to design large-scale threat detection using diverse technologies and data sets
• Skilled in evaluating quantitative and qualitative effectiveness of security measures
• Familiarity with modern engineering and detection engineering practices
• Passion for solving complex security problems in innovative and scalable ways
• A drive for change through continuous improvement
• Capable of working independently but possesses a collaborative mindset
• Ability to work in a fast-paced environment, often juggling multiple projects
• Experience working independently and as part of a team

What's in it for you?

• Join an ambitious tech company reshaping the way people build digital experiences
• Full-time employees receive Stock Options for the opportunity to share ownership and the success of our company
• Comprehensive health/dental/vision care package covering 100% of monthly  premiums for employees
• We value Work-Life balance and You Time! A generous amount of paid time off, including vacation days, education days, and volunteer days
• 6 weeks of paid parental leave to care for and focus on your growing family
• Use your personal education budget to improve your skills and grow in your career
• Enjoy a full range of virtual and in-person events, including workshops, guest speakers, and fun team activities, supporting learning and networking exchange beyond the usual work duties 
• Use your physical fitness budget to get away from your desk and support your physical wellness
• A monthly phone/internet stipend and phone upgrade reimbursement after 2 years
• New hire office equipment stipend. Get the gear you need to work at your best.

This role will need to be conducted in a state in which we are currently registered to do business. 

#LI-Remote #LI-JE1