Incident Response Analyst - Americas

The Carlyle Group Employee Co.•Washington, DC

2d•Hybrid

About The Position

The Incident Response Analyst plays a critical role in protecting the organization’s information, technology platforms, and sensitive financial data from increasingly sophisticated cyber threats. This is a hands-on technical position within the Security Operations Center (SOC), responsible for investigating, containing, and resolving security incidents across endpoint, identity, network, cloud, SaaS, and enterprise environments. The successful candidate will combine strong cybersecurity fundamentals with modern detection, investigation, automation, and threat analysis capabilities to rapidly identify malicious activity and reduce organizational risk. The ideal candidate will possess a strong understanding of incident response, security operations, threat detection, threat hunting, and digital investigation methodologies. They will take ownership of security incidents throughout the response lifecycle, including triage, investigation, containment, eradication, recovery, and post-incident analysis. The analyst will correlate and analyze telemetry from multiple security technologies—including SIEM, XDR, EDR, identity, network, cloud, email, and data protection platforms—to reconstruct attack activity, determine scope and impact, identify root cause, and recommend appropriate remediation actions. Familiarity with contemporary attack techniques and frameworks such as MITRE ATT&CK is essential for understanding adversary behavior and improving detection and response capabilities. This role will be an advocate for an automation-first SOC. The Incident Response Analyst will leverage security orchestration, scripting, APIs, automation platforms, and increasingly AI-assisted security capabilities to accelerate investigations and reduce repetitive manual activities. The analyst should be comfortable identifying opportunities to automate enrichment, evidence collection, alert triage, containment actions, case management, and other repeatable incident response processes while maintaining appropriate human oversight for high-impact decisions. As enterprise environments increasingly span traditional infrastructure and cloud services, the analyst must understand modern attack surfaces across endpoints, identities, networks, cloud infrastructure, SaaS platforms, applications, and data environments. Knowledge of cloud security concepts, identity-based attacks, credential compromise, privilege escalation, lateral movement, data exfiltration, ransomware, phishing, malware, and emerging AI-enabled threats will be important to effectively investigate and respond to modern cyberattacks. The Incident Response Analyst will also contribute to the continuous improvement of the SOC by performing threat hunting, detection engineering, incident retrospectives, playbook development, and security control optimization. Lessons learned from investigations should be translated into improved detections, automated workflows, response procedures, and preventative controls. The analyst will work closely with security engineering, threat intelligence, vulnerability management, identity, cloud, infrastructure, application security, and other technology teams to strengthen the organization's overall detection and response capabilities. Strong communication and sound judgment are equally important. During significant security incidents, the analyst must clearly communicate technical findings, business impact, response actions, and recommendations to both technical and non-technical stakeholders. They must be capable of managing multiple investigations, making risk-based decisions with incomplete information, maintaining accurate incident documentation and evidence, and remaining effective during high-pressure situations. This position provides an opportunity to work with modern security technologies and help shape the evolution of a data-driven, intelligence-led, and highly automated Security Operations Center. The successful candidate will demonstrate technical curiosity, analytical thinking, ownership, collaboration, and a continuous-improvement mindset while helping the organization detect threats earlier, investigate incidents faster, and respond to cyber threats more effectively. In-Office Requirement: 4 days per week

Requirements

Four-year college degree, or equivalent years’ of relevant experience, required.
5+ years of overall IT-related experience, required.
3+ years of IT security operations and incident response experience, required.
In-depth knowledge of incident response methodologies (identify, contain, eradicate, recover, learn).
Proven ability to conduct investigations, analyze evidence, and identify root causes of security incidents.
Experience with digital forensics and evidence collection techniques in various environments (cloud, network, endpoint).
Experience with leveraging APIs to automate integrations between security tools.
Knowledge of cloud security best practices (IAM, encryption, logging).
Ability to prioritize tasks, manage multiple incidents concurrently, and work effectively under pressure.
Strong analytical and problem-solving skills to diagnose complex security incidents.
Excellent communication and collaboration skills to work effectively with security teams, IT teams, and business stakeholders.
Proficiency with security orchestration, automation and response (SOAR) platforms (Palo Alto XSIAM).
Proficiency with security information and event management (SIEM) tools
Proficiency with at least one major cloud platform (AWS, Azure)
Familiarity with Infrastructure as Code (IaC) tools (Terraform, CloudFormation).
Experience with scripting languages (Python, Bash, PowerShell) for automating incident response tasks.
Strong understanding of network security concepts (firewalls, intrusion detection/prevention systems).
Proficiency with endpoint security tools (antivirus, endpoint detection and response (EDR), Application Control).
Working knowledge of various operating systems (Windows, Linux, macOS).

Nice To Haves

Certifications in incident response (GCIH, SANS) or security (CISSP, CCSP) preferred.
Knowledge of financial services industry and alternative asset management, strongly preferred.

Responsibilities

Analyze, investigate, document, contain, remediate, and coordinate response to cybersecurity incidents across endpoint, identity, network, cloud, SaaS, email, application, and data environments.
Maintain ownership of incidents through resolution and ensure appropriate escalation, communication, evidence preservation, and documentation throughout the incident lifecycle.
Serve as an escalation point for security events referred by the Tier 1 Managed Security Service Provider (MSSP) that require deeper technical analysis, validation, or response.
Correlate telemetry across multiple security platforms to determine attack scope, root cause, affected identities and assets, potential business impact, and required containment or remediation actions.
Develop, test, tune, and continuously improve detection logic, correlation rules, analytics, queries, and behavioral detections designed to identify advanced and emerging threats.
Translate lessons learned from incidents and threat hunting activities into improved detection and prevention capabilities.
Identify opportunities to automate repetitive investigation and response activities using scripting, APIs, security orchestration, workflow automation, and AI-assisted security technologies.
Develop and improve automated workflows for alert enrichment, evidence collection, investigation, case management, containment, and remediation while maintaining appropriate human oversight.
Develop, maintain, test, and continuously improve incident response playbooks and operational procedures for common and high-impact security scenarios, including compromised accounts, phishing, malware, ransomware, data exfiltration, insider threats, cloud compromise, and other emerging attack techniques.
Develop and maintain meaningful operational metrics and reporting related to incident response, detection effectiveness, threat hunting, automation, project deliverables, and SOC performance.
Use operational data to identify trends and opportunities to improve detection coverage, response time, and overall security effectiveness.
Maintain and expand technical expertise through research, hands-on lab work, threat research, training, industry engagement, and professional development.
Share knowledge with other analysts, mentor team members, document technical findings, and contribute to improving the overall capabilities and maturity of the Security Operations Center.