Lead Incident Response Analyst

Transocean • Houston, TX

5d

About The Position

The Lead Incident Response Analyst serves as the dedicated lead responder for Transocean’s Cyber Security Incident Response Team (CSIRT). The role leads major cybersecurity investigations and coordinates incident response across enterprise and operational technology environments, including containment, eradication, recovery, and post-incident analysis. It acts as the primary point of contact for incident response activities and coordinates with internal stakeholders, managed security providers, technology teams, and third-party vendors. The position also provides expert guidance on cyber threats, incident response processes, threat intelligence, and ongoing improvement of security operations and incident management capabilities.

Requirements

• Bachelor’s degree in Information Technology, Cybersecurity, or a related field.
• One or more security certifications, such as Security+.
• At least 3 years focused on incident response, threat hunting, security operations, or cyber investigations.

Nice To Haves

• Security certifications such as Security+, GCIH, GCFA, CISSP, CISM, or equivalent.
• 7 or more years of cybersecurity experience leading a Security Operations Center (SOC).

Responsibilities

• Lead and coordinate cybersecurity incident investigations, including triage, analysis, validation, containment, eradication, recovery, and closure.
• Serve as the primary incident commander during major security events, working with management and coordinating Security Operations, Infrastructure, Identity, and Application teams.
• Develop, maintain, and improve incident response procedures, playbooks, runbooks, escalation processes, and detection methodologies.
• Lead post-incident reviews, root cause analysis, and lessons-learned sessions; recommend corrective actions to prevent recurrence.
• Communicate incident status, risks, and remediation activities to technical teams, management, executives, and external stakeholders.
• Mentor and guide junior analysts, MSSP personnel, and incident response stakeholders on incident handling procedures and cyber threats.
• Produce incident metrics, reports, KPI dashboards, and executive summaries to measure CSIRT effectiveness and operational maturity.
• Lead continuous improvement initiatives with Security Engineering teams to enhance detection coverage, automate response activities, improve security analytics, and improve metrics including MTTD and MTTR.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior