CSOC Incident Response Lead

Sherwin-Williams • Cleveland, OH

2h • $108,531 - $140,086 • Remote

About The Position

The CSOC Incident Response Lead oversees and coordinates the organization’s response to security incidents. Acting as the primary decision-maker during a breach, this role leads the incident response team, assesses situations, implements response plans, and communicates with stakeholders throughout the incident lifecycle. The goal is to minimize risk and restore operations quickly and safely. The position calls for strategic thinking, strong leadership and technical skills, and the ability to make informed decisions under pressure. It supports the incident response lifecycle using Security Information and Event Monitoring (SIEM) and Security Orchestration and Automated Response (SOAR) technologies, and reports directly to the CSOC Manager.

This is a remote position. The role requires legal authorization to work in the United States without current or future employer sponsorship. Job duties may involve access to confidential and proprietary information; the company states that a criminal-history review is necessary to protect its business, operations, reputation, personnel, and business relationships.

Requirements

• Bachelor’s degree in computer science, Information Technology, or a related field, or equivalent experience.
• At least 8 years of IT/Cybersecurity experience.
• Proven experience leading and coordinating incident response efforts in a fast-paced environment.
• Strong technical knowledge of network security, malware analysis, intrusion detection, and related technologies.
• Excellent communication and interpersonal skills, including the ability to engage stakeholders at all levels and explain technical information to nontechnical stakeholders.
• Ability to remain calm and focused under pressure and a commitment to delivering results.
• Understanding of operating systems including z/OS, Windows, UNIX, Linux, and AIX.
• Must be at least 18 years old.
• Must be legally authorized to work in the United States without company sponsorship, now or in the future.

Nice To Haves

• Relevant certifications, such as GIAC Incident Handler (GCIH).
• Previous experience with incident response and handling.
• Deep understanding of cybersecurity concepts, including incident response methodologies and threat intelligence.
• Familiarity with cybersecurity frameworks and regulations such as NIST and GDPR.
• Experience with SIEM/SOAR solutions such as Splunk and Sumo Logic.
• CSOC experience or experience working with a Managed Security Service Provider.
• Knowledge of Threat Intelligence Platforms (TIPs) and integrating them into SIEM to support incident response and use of Indicators of Compromise.
• Exposure to incident response in the Operational Technology domain.

Responsibilities

• Serve as the primary point of contact and decision-maker during cybersecurity incidents.
• Support incident response using the full CSOC toolset, including SIEM/SOAR, sandbox, email security, and endpoint detection and response tools.
• Lead and coordinate incident response efforts within the Triage & Response team, including mobilizing resources, assessing situations, and implementing response plans.
• Collaborate with internal and external stakeholders to gather information, assess impact, and prioritize response actions.
• Provide clear and timely incident updates to stakeholders, including executive leadership, throughout the incident lifecycle.
• Implement and refine analysis and forensics processes.
• Implement and refine incident response procedures, protocols, and playbooks.
• Conduct monthly post-incident reviews, identify lessons learned and improvement areas, and enforce consistent remediation of action items with analysts, engineers, and relevant stakeholders.
• Stay informed about emerging cyber threats, vulnerabilities, and incident response best practices through collaboration with Vulnerability Management and Cyber Threat Intelligence teams.
• Hold monthly workshops with Information Technology and Operational Technology stakeholders about ongoing and future incident response initiatives.
• Collaborate with security engineers to improve detection and playbook automation.
• Lead tabletop exercises with CSOC members and internal stakeholders to provide training, identify gaps, and support continuous improvement.
• Assist in managing the incident response database to support audit and compliance requirements.
• Support the CSOC Manager with vendor management of incident response retainers.
• Oversee formal and informal incident response training and identify training opportunities using unused retainer credits.

Benefits

• The company describes a range of benefits intended to support health, well-being, retirement, health care, and daily commuting; candidates are directed to the company’s benefits website for eligible offerings.
• The company describes flexibility and opportunities to learn, develop skills, and grow.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior