Lead, Cyber Incident Response

Sony Pictures Entertainment•Culver City, CA

About The Position

Sony Pictures Entertainment (SPE) is seeking an experienced Lead Cyber Incident Response professional to help protect the company's people, intellectual property, productions, technology platforms, and business operations from cyber threats. This role leads complex cybersecurity investigations, coordinates response activities during significant security incidents, and advances SPE's incident response capabilities. The successful candidate will serve as a senior technical resource within the Incident Response team, leading investigations across corporate, cloud, identity, SaaS, and production environments while partnering with Security Operations, Threat Intelligence, Engineering, Legal, Privacy, People & Organization (P&O), Corporate Communications, and business stakeholders.

Requirements

8+ years of cybersecurity experience, with significant focus on incident response, digital forensics, threat hunting, or security operations.
Proven experience leading enterprise-scale cybersecurity investigations and incident response efforts.
Strong knowledge of modern attack techniques, threat actor behavior, digital forensics, and investigative methodologies.
Experience with cloud security, identity security, endpoint detection and response (EDR/XDR), SIEM, and SOAR platforms.
Excellent analytical, communication, and stakeholder-management skills, including the ability to explain complex technical issues to executive and non-technical audiences.

Nice To Haves

Experience supporting global media, entertainment, technology, or other highly distributed enterprise environments.
Experience investigating incidents involving intellectual property, insider threats, data exposure, or third-party compromise.
Experience with Microsoft 365, Azure, AWS, modern SaaS environments, and identity platforms.
Knowledge of Python, PowerShell, or other scripting and automation technologies.
Relevant industry certifications such as CISSP, GCIH, GCFA, GCIA, GNFA, or equivalent.

Responsibilities

Lead complex cybersecurity investigations from initial detection through containment, eradication, recovery, and post-incident review.
Serve as incident commander for assigned incidents, coordinating technical responders and business stakeholders throughout the response lifecycle.
Investigate ransomware, identity compromise, phishing, insider threats, data exposure, cloud security incidents, and other advanced cyber threats.
Conduct digital forensic investigations to determine root cause, scope, business impact, and remediation requirements.
Investigate threats affecting SPE intellectual property, content, productions, employees, technology platforms, third-party partners, and business operations.
Assess cyber events from both technical and business-risk perspectives, balancing risk reduction with operational continuity.
Partner with Legal, Privacy, People & Organization (P&O), Corporate Communications, and business leadership on sensitive investigations and response activities.
Collaborate with Security Operations, Threat Intelligence, Detection Engineering, and Security Engineering to enhance detection and response capabilities.
Develop and improve incident response playbooks, runbooks, escalation procedures, investigative methodologies, and operational standards.
Drive automation and workflow optimization through SOAR, scripting, AI-enabled capabilities, and emerging technologies.
Lead post-incident reviews and translate lessons learned into measurable security and operational improvements.
Serve as a senior escalation point for complex investigations and high-severity incidents.
Mentor Incident Response analysts through case reviews, training, coaching, and knowledge sharing.
Provide clear technical updates, executive-ready summaries, after-action reports, and risk-informed recommendations.
Contribute to strategic initiatives that strengthen SPE cyber resilience and operational maturity.