Security Operations - Incident Response Coordinator

Pellera

19h•Remote

About The Position

We are seeking a highly skilled and motivated Incident Response Coordinator to join our Security Operations team. This role involves planning, coordinating, and managing responses to security incidents, ensuring accurate execution of processes and timely completion of documentation and communications. The ideal candidate for the Incident Response Coordinator role is an experienced professional with the soft skills that enable effective performance in high-stakes environments. They are an active listener with strong analytical and problem-solving abilities to quickly assess and address complex incidents, and the ability to confidently communicate clear, concise updates to diverse stakeholders, including leadership and external partners. Additionally, they exhibit adaptability, attention to detail, and a commitment to ethical practices, fostering team trust and enhancing overall organizational resilience.

Requirements

Knowledge of business continuity and disaster recovery continuity of operations plans.
Skill in preserving evidence integrity according to standard operating procedures or international standards.
Knowledge of cyber defense and information security policies, procedures, and regulations.
Knowledge of incident categories, incident responses, and timelines for responses.
Knowledge of incident response and handling methodologies
Skill in performing impact assessments
Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth)
Skill in using security event correlation tools
Knowledge of OSI model and underlying network protocols (e.g., TCP/IP)
Knowledge of cloud service models and how those models can limit incident response.
Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services
Knowledge of different classes of attacks (e.g., passive, active, insider, close-in, distribution attacks).
Knowledge of cyber attack stages (e.g., reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks)
Knowledge of malware analysis concepts and methodologies
Knowledge of what constitutes a network attack and a network attack's relationship to both threats and vulnerabilities
Skill in recognizing and categorizing types of vulnerabilities and associated attacks
Strong knowledge of incident response processes, attack vectors, threat tactics, and detection methods
Experience with DNS Security, SIEM and SOAR systems, endpoint detection tools, forensic software, and security monitoring solutions
Excellent analytical, problem-solving, and communication skills, with the ability to perform under pressure
Familiarity with regulatory requirements, security frameworks, and incident response standards (e.g., NIST, ISO 27001)
Proactive mindset focused on continuous improvement, training, and cross-departmental collaboration
Bachelor’s degree in computer science, Information Technology, Cybersecurity, or a related field or equivalent work experience of 5 years or more
Minimum of 2 years of experience in cybersecurity incident response or a related role

Nice To Haves

Outstanding English language communication skills, both written and verbal.
Professional certifications such as CISSP, ECIH, GCFE, GCIH
Experience with digital forensics and malware analysis
Knowledge of network protocols and security architecture
Familiarity with malware types and attack methods
Experience with scripting and automation tools

Responsibilities

Coordinate the investigation, containment, recovery, and remediation of cybersecurity incidents, collaborating with IT, legal, communications, and third parties as needed
Serve as the primary contact during incidents, providing status updates and coordinating activities with leadership, internal teams, and external partners
Monitor and analyze network traffic, security logs, and alerts to identify, triage, and respond to suspicious activity and potential incidents
Document after action incident details, actions taken, timelines, and lessons learned in line with organizational standards
Conduct periodic incident response exercises, deliver training, and raise awareness among staff on emerging threats and protocols
Collect intrusion artifacts (e.g., source code, malware, trojans) and use discovered data to enable mitigation of potential cyber defense incidents within the enterprise
Continuously review and improve the incident response plan, procedures, and playbooks based on post-incident reviews and lessons learned
Perform initial triage and analysis of security incidents to assess scope, urgency, and impact.
Guide cross-functional teams to contain threats, eradicate vulnerabilities, and restore normal operations
Coordinate with the Corporate Leadership, Security Operations Center (SOC), and external parties as required
Lead after-action reviews, publish findings, and recommend mitigation measures to strengthen future defenses
Stay current with evolving threats, vulnerabilities, and best practices through threat intelligence monitoring and external sources