Incident Response (DFIR) Case Manager - Cybersecurity

FRSecure•Edina, MN

8d•Remote

About The Position

The Incident Response (DFIR) Case Manager is responsible for providing support to clients when they have become or suspect they may be the victim of a cyber-attack. This is done by conducting high quality and timely incident response investigations in environments of varying security maturity including identification and containment phases and advising clients regarding recovery and remediation steps to assist them in returning to normal business operations. Our Incident Response Case Managers have a blend of proactive project responsibilities, such as leading tabletops and plan coaching, as well as triage and case work.

Requirements

3-5 years of information security experience
3-5 years of experience with Active Directory, Systems Administration, Exchange Administration, M365 and/or other cloud environments
3-5 years of experience in presenting information security concepts
Prior experience in threat hunting and/or incident handling
Prior experience in management of EDR and/or SIEM technologies
Experience with firewalls and network devices best practices and logging
Solid understanding of computer systems administration in large environments
Demonstrated analytical skills to interpret data, identify trends, and ensure accuracy in all deliverables
Ability to clearly convey complex information to diverse audiences and actively listen to understand needs and provide effective solutions
Proven customer service skills with a customer-focused mindset, including the ability to build relationships, resolve issues effectively, and deliver a positive, responsive client experience
Ability to communicate highly technical topics to non-technical people effectively
Ability to handle and work with large amounts of data
Proficient with all Microsoft Office Suite products

Nice To Haves

GCIH, GCFA, ECIH certifications preferred

Responsibilities

Performing a forensic review of client systems for artifacts and indicators of compromise (IOCs) to further identify, contain, and eradicate malware and/or malicious intruders
Conducting triage, threat-hunting, and case management for incident response clients
Documenting detailed evidence, findings, and create a report output
Meeting with clients during the planning, information sharing, and technical support stages
Creating and delivering proactive projects to clients including tabletop exercises, plan coaching, assessments
Conducting regular calls with clients to consult on incident response programs
Continue education by researching and investigating developments in cyber forensics/attack methodologies; increase existing skillset to handle these matters
Attending and participating in regular internal meetings
Participating in on-call rotation, providing timely and effective support to clients, ensuring adherence to service level agreements (SLAs) and resolving issues within established response and resolution times
Performing periodic after-hours and weekends on-call work