Incident Responder

JetBlue Airways Corporation•New York, DC

1d•$90,500 - $128,600•Hybrid

About The Position

At JetBlue, cyber security operates across a complex IT environment, encompassing traditional data centers, Software as a Service (SaaS) services, multiple cloud providers, e-commerce platforms, and a diverse end-user environment. We are seeking an experienced Incident Response Analyst to support the Cyber Security Incident Response function through escalated alert triage, investigation, containment support, and response activities. The ideal candidate has hands-on experience analyzing security telemetry across multiple tools, can work independently through ambiguous investigations, and can clearly document findings, risk, and recommended next steps.

Requirements

Bachelor's Degree in Cyber Security, Computer Science, Information Technology, or other relevant discipline; OR demonstrated capability to perform job responsibilities with a High School Diploma/GED and at least four (4) years of previous relevant work experience on a SOC, Incident Response, Threat Detection, or cyber security operations team.
Three (3) years of hands-on experience performing alert triage, security investigations, incident response support, or similar technical security operations work.
Demonstrated ability to analyze disparate data sources such as network logs, endpoint activity, authentication logs, cloud logs, email data, and SIEM events to assess suspicious or malicious activity.
Experience investigating common security events such as phishing, malware, suspicious logins, anomalous network traffic, unauthorized access, suspicious process execution, or endpoint compromise.
Ability to assess risk, determine likely impact, scope activity, and make appropriate escalation recommendations based on available evidence.
Strong problem-solving and analytical skills, including the ability to work through ambiguous or incomplete information.
Ability to demonstrate a high level of critical thinking and sound judgment during technical investigations.
Ability to pass a live skills demonstration or technical interview on-site with JetBlue Crew Members.
Experience with scripting, querying, or automation languages such as PowerShell, Python, KQL, SPL, or similar technologies.
Ability to manage multiple cases and priorities in a fast-paced operational environment.
Excellent written and verbal communication skills, including the ability to clearly document investigations and summarize technical findings.
Available and willing to participate in periodic on-call duties and off-hours Incident Response as required.
Available for occasional overnight travel (10%).
Must pass a ten (10) year background check and pre-employment drug test.
Must be legally eligible to work in the country in which the position is located.
Authorization to work in the United States is required. This position is not eligible for visa sponsorship.
Must be eligible to hold a US government security clearance if JetBlue deems it relevant to the role.

Nice To Haves

Five (5) or more years of experience in a SOC, Incident Response, Threat Detection, cybersecurity operations, or similar blue team function.
Experience triaging and investigating security incidents in an enterprise environment or managed security services environment.
Hands-on experience with SIEM platforms such as Splunk and EDR tools such as SentinelOne, CrowdStrike, Microsoft Defender, or similar technologies.
Experience with SOAR or case management platforms, including documenting investigations, tracking actions, and following structured playbooks.
Thorough understanding of networking principles such as DNS, TCP/IP, HTTP/S, proxies, firewalls, VPNs, and how they relate to security investigations.
Basic knowledge of one or more cloud environments such as AWS, Azure, or Google Cloud and related cloud security investigation concepts.
Experience with identity and access investigations, including MFA events, session activity, privileged access, and account compromise indicators.
Familiarity with common attacker tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT&CK.
Experience supporting phishing, business email compromise, malware, endpoint compromise, suspicious authentication, web application, or data exposure investigations.
Experience building dashboards, saved searches, alert logic, scripts, or other investigative content in security tooling.
Airline, transportation, critical infrastructure, or large-enterprise experience in Security Operations, Incident Response, Threat Detection, or Threat Intelligence.
Strong sense of urgency, ownership, and drive to continuously improve the craft of incident response.

Responsibilities

Monitor, triage, and investigate escalated security alerts and cases from internal tools, managed security providers, and other reporting channels.
Analyze telemetry from multiple sources, including SIEM, endpoint detection and response tools, identity platforms, email security tools, cloud platforms, network devices, CDNs, and WAF technologies.
Investigate suspicious or malicious activity, including phishing, malware, suspicious authentication, anomalous network activity, unauthorized access, endpoint compromise, and potential data exposure.
Perform investigative scoping to identify affected users, hosts, accounts, applications, indicators, timelines, and potential business impact.
Support incident response activities, including evidence gathering, containment support, remediation validation, and communication of technical findings.
Execute approved response actions in accordance with established procedures, including account, endpoint, email, URL/domain, or indicator-based response steps.
Create clear, defensible case notes and incident documentation, including observed activity, entities involved, timeframe, scope, conclusion, and remediation or follow-up actions.
Collaborate with Threat Intelligence, Detection Engineering, Security Monitoring, IT Operations, Identity, Infrastructure, application teams, and other stakeholders during investigations.
Identify detection gaps, logging gaps, process breakdowns, recurring alert patterns, and opportunities to improve security monitoring and response capabilities.
Build or support dashboards, searches, playbooks, reports, process documentation, and other operational improvements that improve incident response efficiency and quality.
Provide guidance and support to less experienced analysts during triage, investigation, documentation, and escalation activities.
Other duties as assigned.