Lead Incident Response Analyst

Hologic•Marlborough, MA

About The Position

As a senior member of Hologic’s enterprise Threat Detection and Response team, the Lead Incident Response Analyst supports a 24x7x365 operation monitoring security-related information sources to detect and manage cyber, privacy, and data-protection incidents affecting Hologic data and infrastructure. The team hunts across the Hologic network for signs of compromise, malware, or unauthorized access; develops and maintains incident response plans, playbooks, and procedures; and collects and analyzes incident response data. The role leads incidents from detection through containment, eradication, and recovery, coordinating response with IT, Legal, Privacy, Communications, and business stakeholders. It also mentors analysts, improves detections and response workflows, develops incident-response and SOAR automation playbooks, and communicates findings and recommendations to managers and senior leadership. Shift and/or on-call work, including weekends, may be required.

Requirements

Bachelor’s degree in a related field, or equivalent experience.
5+ years of information security experience focused on incident response or threat detection.
Demonstrated experience leading incidents and mentoring or guiding other analysts.
Strong knowledge of incident response principles and processes.
Experience with EDR analysis and rule creation, and with dissecting attacker tactics and techniques.
Expert-level experience with Splunk, including reporting and data correlation.
Excellent analytical and problem-solving skills.
A learning mindset and enthusiasm for new technologies and security disciplines.

Nice To Haves

In-depth knowledge of Splunk’s architecture and underpinnings.
Previous experience in cloud-native or technology environments.
Network or Linux knowledge.
Programming or scripting experience.
Experience developing SOAR workflows, including agentic and non-agentic automation; training is provided for candidates new to SOAR.
Security certifications such as GCTI, GCIH, GCIA, or GPEN.

Responsibilities

Lead security incidents from detection through containment, eradication, and recovery, serving as incident commander and coordinating across IT, Legal, Privacy, Communications, and business stakeholders.
Track relevant vulnerabilities, threat actors, indicators of compromise, tactics, techniques, procedures, and emerging trends, translating intelligence into actionable insights.
Partner with Crisis Management to activate and execute crisis procedures when necessary.
Use threat intelligence to proactively hunt across the Hologic enterprise for anomalous or malicious activity.
Work with Security Engineering to baseline user behavior and events and build new detections and response workflows.
Mentor and guide analysts, review investigations and escalations, and set quality standards for detections, playbooks, and case documentation.
Lead post-incident reviews, document root causes and lessons learned, and drive remediation actions to closure.
Recommend and build countermeasures based on threat analysis and intelligence.
Develop, implement, and maintain security incident playbooks and runbooks, including SOAR-driven automation workflows.
Test and improve operational effectiveness through purple team exercises.
Prepare and present findings and recommendations through briefings, reports, and dashboards to managers, team leads, and senior leadership.