Lead Incident Response Analyst

Hologic•Marlborough, MA

3d•$114,000 - $178,300

About The Position

As a senior member of Hologic’s enterprise Threat Detection and Response team, the Lead Incident Response Analyst helps provide 24x7x365 monitoring of security-related information sources to detect and manage cyber, privacy, and data-protection incidents affecting Hologic data and infrastructure. The team hunts across the Hologic network for signs of compromise, malware, or unauthorized access; develops and maintains incident response plans, playbooks, and procedures; and collects and analyzes incident response data. The role leads security incidents from detection through recovery, coordinates response across technical and business stakeholders, and helps strengthen detection and response capabilities through threat hunting, automation, mentoring, and operational improvements. It supports a 24x7x365 operation and may require shift and/or on-call work, including weekends. The annualized base salary range is $114,000–$178,300, and the role is bonus eligible. Final compensation depends on factors including relevant experience, skillset, knowledge, geography, education, business needs, and market demand. Hologic provides comprehensive onboarding training and continued development and training throughout an employee’s career.

Requirements

Bachelor’s degree in a related field, or equivalent experience.
5+ years of information security experience focused on incident response or threat detection.
Demonstrated experience leading incidents and mentoring or guiding other analysts.
Strong knowledge of incident response principles and processes.
Experience with EDR (Endpoint Detection & Response) analysis and rule creation, and with dissecting attacker tactics and techniques.
Expert-level experience with Splunk, including reporting and data correlation.
Excellent analytical and problem-solving skills.
A learning mindset and enthusiasm for new technologies and security disciplines.

Nice To Haves

In-depth knowledge of Splunk’s architecture and underpinnings.
Previous experience in cloud-native or technology environments.
Network or Linux knowledge.
Programming or scripting experience.
Experience developing SOAR workflows, including agentic and non-agentic automation; training is provided for candidates new to SOAR.
Security certifications such as GCTI, GCIH, GCIA, or GPEN.

Responsibilities

Lead security incidents from detection through containment, eradication, and recovery, serving as incident commander and coordinating response across IT, Legal, Privacy, Communications, and business stakeholders.
Stay current on relevant vulnerabilities, threat actors, indicators of compromise (IOCs), tactics, techniques, procedures (TTPs), and emerging trends, and turn intelligence into actionable insights.
Partner with Crisis Management to activate and execute crisis procedures when necessary.
Use threat intelligence to proactively hunt across the Hologic enterprise for anomalous or malicious activity.
Work with Security Engineering to baseline user behavior and events, and build new detections and response workflows.
Mentor and guide analysts, review investigations and escalations, and set quality standards for detections, playbooks, and case documentation.
Lead post-incident reviews, document root cause and lessons learned, and drive remediation actions to closure.
Recommend and build countermeasures based on threat analysis and intelligence.
Develop, implement, and maintain security incident playbooks and runbooks, including building SOAR-driven automation workflows.
Routinely test and improve operational effectiveness through purple team exercises.
Prepare and present findings and recommendations through briefings, reports, and dashboards to managers, team leads, and senior leadership.