Engagement Lead, Incident Response

Arete

2d•Onsite

About The Position

The Engagement Lead, Incident Response is responsible for leading and managing incident response engagements. This role involves technical leadership, client education, strategy development, and team management to ensure successful outcomes for clients facing security incidents. The position requires a deep understanding of various technologies, infrastructure, and cybersecurity tools, as well as strong communication and leadership skills.

Requirements

Minimum of 7 years conducting digital investigations or leading full-cycle incident response investigations for a major consulting firm or global IR company.
Bachelor's degree in a computer science related discipline and 8+ years related experience or Master's Degree and 6+ years related experience or J.D. and 4+ years related experience.
Minimum of 1 industry certifications: GCFA, GCFE, GCIH, GISP, CISSP, Security+, MCSC, Network+, or equivalent.
Excellent time management and organizational skills.
Widely recognized technical abilities.
Ability to teach others.
Proficiency with reading the room and adjusting conversational style accordingly.
Ability to navigate difficult conversations effortlessly.
Expert at managing client expectations.
Ability to independently train, mentor, coach and lead team members globally and take ownership over their wins and losses.
Ability to lead projects with security implementations.
Thorough background or knowledge of network enterprise systems administration.
Thorough knowledge and understanding of operating systems and hardware architectures: Linux/Unix, Mainframe, Windows, Cloud, etc.
Thorough knowledge and experience with core set of standard Industry technology and platforms and familiarity with cybersecurity tools.
Knowledge of Enterprise architecture.
Network segmentation.
On-premises technologies, Physical and Virtual Servers, Firewalls, routers, storage, Security Information Event Management (SIEM), Multi-factor authentication.
DMZ configurations.
Thorough knowledge of containment, preservation, and acquisition of data within compromised IT environments.
Thorough knowledge of email servers: on-premises, cloud hosted, and third-party hosted.
Demonstrates deep understanding of configurations.
Understands how email servers connect to or authenticate with Active Directory (AD).
Understands how to collect relevant logs from popular email services (Exchange, Exchange Online, Google Workspace, and M365).
Familiarity with or knowledge of how to familiarize oneself with additional platforms as required.
Comfortable directing IT personnel to perform collection of required log information.
Knowledgeable with securing email platforms and directing IT administrators on proper configuration techniques.
Ability to establish priorities, work independently and proceed with objectives with minimal supervision.

Nice To Haves

Hands-on experience with cybersecurity tools is a plus.
Endpoint Detection and Response (EDR) solutions.
E-mail platforms: Microsoft Office (M365), On-premises Exchange, Google Workspace.
Anti-virus (AV) vendors.
Identity Access Management (IAM)/Zero Trust systems.
Disaster Recover Plans.
Firewall and Virtual Private Network (VPN) platforms.
Remote access tools.
Cloud Provider Platforms: Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP).

Responsibilities

Respond to Client, Counsel, Carrier (CCC) requests in accordance with Key Performance Indicators (KPIs) and urgency.
Lead the technical conversation and drive the direction and strategy of the engagement.
Educate the Client on making informed decisions and conducting cost vs. benefit analysis.
Maintain accountability for accurate and timely password changes within 24 hours.
Build and deliver the strategy for success.
Assist clients with developing and executing their recovery plans.
Establish priorities for IT and Arete engagement personnel.
Serve as the subject matter expert on various technologies, infrastructure, and engagement-specific items.
Track progress to completion.
Communicate clearly and manage priorities by role, ensuring each team member understands their tasks, values, and time to deliver.
Ensure project workstreams are delivered on-time.
Monitor budget and team hours against allocated hours within the statement of work (SOW).
Ensure daily time entry is complete within the Project management tool for the team.
Ensure project budget is correct, identify potential overages, and request amendments when workstream budgets reach 75%.
Ensure the engagement team is utilized to a blended 70%.
Identify opportunities for add-on services to continue assisting Clients with Arete resources.
Ensure teams execute tasks successfully and validate work product quality.
Provide routine updates to CCC regarding overall engagement and action items.
Deliver to the Client on-time based on agreed upon service level agreement (SLA) and/or as needed.
Coach and mentor junior team members.
Propose tactics and strategies that impact overall processes.
Perform other duties as assigned by management.