Cybersecurity Incident Response Lead

Stoke Space • Kent, WA

5d

About The Position

At Stoke, the Cybersecurity Incident Response Lead will lead the detection, investigation, containment, and recovery of cybersecurity incidents affecting infrastructure, engineering environments, manufacturing systems, and sensitive aerospace data. This hands-on technical leadership role owns incident response readiness and execution, leads complex investigations, coordinates response across teams, and turns findings into practical improvements that reduce risk and strengthen response capabilities.

The role provides technical direction and mentorship while working closely with IT, security, software engineering, manufacturing, and operations. It requires balancing decisive response with operational safety and continuity, and keeping technical teams and leadership informed as incidents evolve. The person must be able to stay focused, move quickly, self-direct, and learn on the fly. The role also participates in on-call coverage and after-hours response for critical incidents.

Stoke is building Nova, a fully and rapidly reusable launch vehicle designed for daily flight. The company describes its team as mission-driven, collaborative, and empowered to take ownership of their work.

Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent practical experience.
• 5+ years of experience in cybersecurity operations, incident response, digital forensics, or a related technical field, including hands-on leadership of complex security incidents.
• Demonstrated ability to investigate and contain security incidents, determine scope and impact, and coordinate recovery across multiple technical teams.
• Strong understanding of Windows and Linux systems, identity and access management, networking, cloud infrastructure, and common attacker techniques.
• Hands-on experience with SIEM and endpoint detection and response platforms, log correlation, forensic triage, and evidence preservation.
• Ability to write investigation queries and automate repeatable analysis or response tasks using tools such as KQL, Python, PowerShell, or Bash.
• Sound judgment under pressure, including the ability to prioritize actions based on threat activity, business impact, and operational constraints.
• Clear written and verbal communication skills, with experience producing investigation reports and briefing technical and nontechnical stakeholders.
• Ability to lead through influence, mentor colleagues, and drive corrective actions to closure across organizational boundaries.
• Must be a U.S. citizen, lawful permanent resident of the U.S. (current Green Card holder), or protected individual as defined by 8 U.S.C. 1324b(a)(3), to conform to ITAR requirements.
• Employment is contingent upon satisfactory reference and background checks and the ability to prove identity and authorization to work in the U.S.
• Must complete an Employment Eligibility Verification Form I-9 at the start of employment and re-verify authorization to work periodically; continued employment may depend on legal authorization to access export-controlled materials as necessary for the role.

Nice To Haves

• Experience with Microsoft Sentinel, Defender, Entra ID, Microsoft 365, and investigations in AWS or Azure environments.
• Experience with disk and memory forensics, malware triage, threat hunting, or investigations involving ransomware, identity compromise, and data theft.
• Experience building an incident response program, running exercises, or coordinating external incident response providers.
• Familiarity with MITRE ATT&CK and incident response practices aligned with NIST; experience supporting NIST 800-53/171, FedRAMP, ISO 27001, SOC 2, or CUI protection requirements.
• Experience supporting aerospace, manufacturing, operational technology, or other environments where response actions must account for safety and availability.
• Relevant certifications such as GCIH, GCFA, GCFE, or equivalent demonstrated expertise.
• Prior experience in a startup environment, demonstrating adaptability, resourcefulness, and a hands-on approach to security.

Responsibilities

• Lead cybersecurity incidents from initial triage through containment, eradication, recovery, and closure; establish severity, scope, response priorities, and escalation paths.
• Serve as the technical incident lead by coordinating responders, assigning actions, maintaining decision records, and escalating business risks and resource needs.
• Investigate endpoint, identity, network, cloud, and application activity to reconstruct timelines, identify initial access and persistence, and assess affected systems and data.
• Collect and preserve logs, forensic artifacts, and other evidence with documented handling, chain of custody, and appropriate access controls.
• Coordinate containment and recovery with system owners, validate remediation, and monitor for recurrence; align actions affecting manufacturing, test, or launch systems with operational and safety requirements.
• Maintain the incident response plan, escalation procedures, and playbooks for scenarios such as compromised accounts, ransomware, data exfiltration, and cloud compromise.
• Improve detection coverage and response workflows using SIEM, endpoint detection and response, threat intelligence, and automation; identify telemetry gaps and tune alerts.
• Conduct threat hunting and translate investigation findings into detection rules, control improvements, and prioritized remediation with accountable owners.
• Provide clear incident updates and reports that distinguish confirmed findings from uncertainty and explain business impact, response actions, and outstanding risks.
• Coordinate with leadership, legal, compliance, and external response partners to support evidence requests and applicable notification obligations.
• Lead tabletop exercises and post-incident reviews; track corrective actions and measure response effectiveness, readiness, and recurring failure patterns.
• Mentor responders, maintain investigation standards, and participate in on-call coverage and after-hours response for critical incidents.
• Perform additional duties as assigned to support organizational goals and objectives.

Benefits

• Equity in the form of stock options for all regular, full-time employees.
• Comprehensive benefits program including subsidized medical, dental, and vision insurance.
• Company-paid life and disability insurance.
• 401(k) plan with employer match.
• 4 weeks’ Paid Time Off.
• 11 holidays, including an end-of-year closure.
• Paid Family/Parental Leave.
• On-site gym or monthly wellness stipend, depending on location.
• Dog-friendly offices.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior