Incident Response Lead

Zelis Healthcare • Atlanta, GA

21h • Hybrid

About The Position

The Incident Response Lead is a senior, hands-on technical lead responsible for investigating, containing, and responding to cybersecurity incidents across the organization. The role leads complex investigations, performs digital forensics and incident response (DFIR) analysis, and coordinates response from initial detection through containment, eradication, recovery, and post-incident review. It combines deep technical expertise with incident leadership, including analyzing digital evidence, establishing timelines and root cause, guiding analysts, and coordinating with teams across the organization.

The role also strengthens detection and response capabilities by improving processes, developing investigative techniques, sharing knowledge, and identifying automation opportunities. A component of the position focuses on Data Loss Prevention (DLP) and insider risk initiatives, including investigation, analysis, response, and development of processes and procedures.

The position participates in a rotating on-call schedule as required. Workplace expectations vary according to the position and business needs. Zelis uses a flexible hybrid approach, with in-office presence guided by team and business needs rather than a fixed weekly schedule. Candidates within approximately 50 miles of a U.S. office are generally preferred.

Requirements

• At least 4 years of hands-on DFIR, cybersecurity incident response, or equivalent enterprise security investigation experience.
• Demonstrated experience leading or serving as a senior technical responder during complex cybersecurity incidents.
• Hands-on experience investigating compromised endpoints, identities, cloud environments, network activity, or other enterprise security events.
• Experience performing forensic analysis and correlating evidence across security data sources to establish incident scope, timelines, root cause, and impact.
• Strong understanding of the incident response lifecycle, including preparation, detection and analysis, containment, eradication, recovery, and post-incident activities.
• Working knowledge of common attacker techniques and the ability to apply investigative methodologies to identify malicious activity.
• Experience with enterprise security technologies such as SIEM, EDR/XDR, SOAR, network security tooling, cloud security platforms, and forensic tools.
• Ability to partner effectively with enterprise teams in a cybersecurity context and coordinate technical activities during active investigations.
• Effective written and verbal communication skills, including documenting investigations and communicating technical findings to technical and non-technical stakeholders.
• Experience developing or improving cybersecurity processes, procedures, playbooks, or technical documentation.
• Commitment to maintaining technical proficiency in incident response, digital forensics, threat analysis, and related cybersecurity disciplines.
• Ability to provide technical leadership and mentorship while remaining a hands-on contributor.
• Bachelor’s degree in Computer Science, Engineering, Information Security, Information Technology, or a related field, or equivalent professional experience.
• Must not require visa sponsorship now or in the future.

Nice To Haves

• Advanced cybersecurity or DFIR certifications such as GCFA, GCIA, GNFA, GCTI, GREM, GCIH, GPEN, OSCP, or similar.
• Experience investigating DLP, insider risk, data exfiltration, or other data security incidents.
• Experience responding to incidents involving AWS, Azure, or GCP environments.
• Cloud security or cloud platform certifications.
• Proficiency with Python, PowerShell, Bash, or similar scripting or programming languages for investigation and response automation.
• Experience with SIEM, SOAR, EDR/XDR, malware sandboxing, forensic analysis platforms, and related security technologies.
• Familiarity with threat intelligence and frameworks such as MITRE ATT&CK and their application to incident investigation and response.

Responsibilities

• Lead cybersecurity incidents from initial identification and triage through investigation, containment, eradication, recovery, and post-incident activities.
• Provide technical direction during complex or high-severity incidents and coordinate response activities across participating teams.
• Perform forensic analysis of endpoints, systems, files, logs, cloud environments, network data, and other artifacts to determine scope, root cause, attack paths, timelines, and impact.
• Triage security alerts and escalations, investigate suspicious activity, develop investigative hypotheses, correlate evidence across data sources, and determine response actions.
• Investigate potential data loss and insider risk events, identify suspicious activity patterns, and help develop and mature DLP and insider-risk investigation and response processes.
• Ensure security telemetry and forensic evidence are collected, preserved, normalized, and available for investigation and analysis.
• Partner with SOC, IT, Cloud, Engineering, Legal, Privacy, HR, and other appropriate teams to gather evidence, assess risk, and coordinate technical response actions.
• Mentor analysts by sharing investigative techniques, reviewing complex cases, providing guidance, and conducting training or knowledge-sharing sessions.
• Serve as an escalation point for complex investigations and advise on security tooling, forensic techniques, investigative methodologies, and incident response workflows.
• Help manage investigation priorities, monitor active incidents, ensure appropriate documentation and handoffs, and participate in a rotating on-call schedule as required.
• Document significant incidents, including findings, timelines, root cause, impact, response actions, and lessons learned; identify and track opportunities to improve detection and response.
• Identify gaps in telemetry, detections, tooling, processes, and response capabilities based on investigations and emerging threats.
• Improve investigative efficiency through tools, scripting, automation, integrations, and process improvements.
• Review security alerts, logs, and telemetry; lead or assist with active incidents and drive investigations toward containment and resolution.
• Communicate technical findings to technical and non-technical stakeholders and participate in post-incident reviews.
• Share investigative techniques, threat knowledge, and tooling capabilities with the broader team.
• Perform other tasks required by management as needed.

Benefits

• 401(k) plan with employer match
• Flexible paid time off
• Holidays
• Parental leaves
• Life and disability insurance
• Medical, dental, vision, and prescription drug coverage
• Potential discretionary bonus plans, commissions, or other incentives depending on the role

What This Job Offers

• Job Type: Full-time
• Career Level: Senior