Global Director of Autonomous Incident Response and Forensic Analysis

MUFG•Jersey City, NJ

1d•$182,000 - $249,000•Hybrid

About The Position

The Global Director of Autonomous Incident Response and Forensic Analysis leads the strategy, execution, and continuous improvement of a 24/7 global incident response (IR) and digital forensics function. This role is accountable for orchestrating rapid containment, eradication, and recovery for security incidents while ensuring high-quality investigative rigor, evidence handling, and executive-ready reporting. The director operates under the Global Head, helping shape the overarching vision and translating it into operating models, playbooks, and measurable outcomes; the role also partners closely with the SOC Director to ensure seamless handoffs from detection/triage into investigation and response and to drive feedback loops that improve detections and alert fidelity. Additionally, the role advances AI-assisted, human-in-the-loop forensics and response by applying AI/ML and LLM-enabled workflows (e.g., enrichment, case summarization, artifact correlation, and response recommendations) with appropriate governance, controls, and analyst validation to improve speed and consistency without sacrificing investigative integrity. The director owns budget planning and financial stewardship for the function and ensures service delivery across regions, environments, and partners.

Requirements

Bachelor’s degree in Information Technology, Cyber Security, Computer Science, or related discipline or equivalent work experience
7+ years of experience working in the Cybersecurity Operations or Information Security
Experience with information security risk management, including information security audits, reviews, and risk assessments
Security event monitoring, investigation, and overall incident response process
Strong time management skills to balance multiple activities and lead junior analysts as needed
Understanding of offensive security to include common attack methods
Understanding of how to pivot across multiple datasets to correlate artifacts for a single security event
A diverse skill base in both product security and information security including organizational structure and administration practices, system development and maintenance procedures, system software and hardware security controls, access controls, computer operations, physical and environmental controls, and backup and recovery procedures.
Detailed knowledge and experience in security and regulatory frameworks (ISO 27001, NIST 800 series, FFIEC, SOC2, FedRAMP, STAR, etc.)
Ability to guide and mentor junior analysts in investigations
Understanding of enterprise detection and response technologies and processes (advanced threat detection tools, intrusion detection/prevention systems, network packet analysis, endpoint detection and response, firewalls, Anti malware/anti-virus, Security Information and Event Management tools, etc.)
Experienced with Endpoint Detection & Response, email security, web application firewall, and cloud security tooling.
Ability to perform risk analysis utilizing logs and other information compiled from various sources
Understanding of network protocols, operating systems (Windows, Unix, Linux, MacOS, databases), and mobile device security
Knowledge of the various types of cyber-attacks and their implementations
A fundamental understanding of enterprise cybersecurity frameworks such as MITRE ATT&CK and Cyber Kill Chain
Ability to document and explain technical details in a concise, understandable manner
Experience in operational processes such as security monitoring, data correlation, troubleshooting, security operations, etc.

Nice To Haves

Relevant technical and industry certifications, such as CISSP, ISSMP, GCIA, CISM, CEH, GCFA, GCFE, GCIH, or GSEC are preferred
Experience in one or more security domains including Security Governance and Oversight, Security Risk Management, Network Security, Threat and Vulnerability Management, or Incident Response and Forensics preferred
Well-developed analytic, qualitative, and quantitative reasoning skills
Demonstrated creative problem-solving abilities
Scripting/programming experience preferred
Preferred experience with Torq, 7AI, CrowdStrike, Tanium, Snowflake, Splunk, and ELK

Responsibilities

Direct and mature a 24/7 global incident response and digital forensics operating model, including intake, investigation, containment/eradication coordination, and recovery validation across multiple environments
Own functional strategy, multi-year roadmap, and KPI/OKR outcomes for incident response and forensics (e.g., time to contain, time to remediate, investigation cycle time, repeat-incident reduction, and readiness metrics)
Work with the Global Head to define the vision for Autonomous Incident Response and Forensic Analysis, and execute against that vision in alignment with the strategic design
Partner with the SOC Director to define clear handoffs from detection/triage into investigation, establish escalation criteria, and implement feedback loops that improve detections, alert quality, and response playbooks
Oversee budget planning, vendor management, and financial governance for global cyber operations tooling, services, and staffing; optimize spend to risk reduction and service performance
Lead, mentor, and scale high-performing global teams (employees and partners); define operating rhythms, coverage models, escalation paths, and on-call expectations
Serve as a lead escalation contact in a 24/7 environment; guide appropriate resources to resolution
Provide executive-level oversight for audit, risk, and regulatory engagements related to cyber operations; ensure processes, evidence, and metrics meet policy and compliance requirements
Deliver leadership reporting on cyber operations health, emerging threats, and risk posture; translate technical findings into business impact and prioritized actions
Drive AI-assisted, human-in-the-loop incident response and forensics initiatives, including evidence/artifact enrichment, timeline reconstruction, case summarization, correlation across telemetry sources, and response recommendations with analyst validation and governance
Establish governance for IR playbooks/runbooks, case management workflows, evidence handling and retention, and chain-of-custody practices to ensure investigations are consistent, defensible, and repeatable
Provide incident command leadership for high-severity events; coordinate containment and recovery execution with infrastructure, identity, endpoint, cloud, application, legal, privacy, and communications stakeholders
Oversee third-party IR/forensics capabilities and managed services (as applicable) to ensure coverage, quality, evidence standards, and alignment to enterprise policies and SLAs
Build an IR operations analytics program to measure and continuously improve containment speed, investigation throughput, backlog health, automation effectiveness, and quality of outcomes across regions and shifts
Lead incident readiness and validation exercises (e.g., tabletop exercises and technical simulations with relevant teams), and ensure post-incident reviews drive measurable improvements to controls, detections, and response procedures
Build and maintain forensic readiness capabilities, including standardized collection methods, artifact baselines, and investigative playbooks to accelerate triage-to-proof and reduce dwell time
Provide global operational leadership during cyber events by coordinating communications, handoffs, and technical execution across regions, functions, and time zones
Leverage threat intelligence and adversary TTP research to inform scoping, attribution hypotheses, containment prioritization, and investigative direction; translate insights into improved prevention and detection
Produce and govern recurring and ad-hoc reporting on threats, trends, and program performance; ensure consistent narratives and decision support for stakeholders
Champion innovation and modernization of cyber defense tooling and techniques, including evaluation and adoption of new capabilities that measurably reduce risk
Partner with technology, product, and business leaders to align cyber operations priorities, drive remediation ownership, and embed security-by-design practices