Lead Incident Response Analyst

Transocean • Houston, TX

1d

About The Position

Transocean is seeking a dedicated lead responder for its Cyber Security Incident Response Team (CSIRT). This role is responsible for leading the investigation, coordination, containment, eradication, recovery, and post-incident analysis of cybersecurity incidents across both enterprise and operational technology environments. The Lead Incident Response Analyst will act as the primary point of contact for all cybersecurity incident response activities, collaborating with internal stakeholders, managed security providers, technology teams, and third-party vendors. This position also provides expert guidance on cyber threats, incident response processes, threat intelligence, and continuous improvement of the organization's security operations and incident management capabilities.

Requirements

• Bachelor's degree in Information Technology or Cybersecurity
• Related Experience
• One or more security certifications such as Security+
• 3 years focused on incident response, threat hunting, security operations or cyber investigations

Nice To Haves

• Bachelor's degree in Information Technology or Cybersecurity
• Related Experience
• One or more security certifications such as Security+, GCIH, GCFA, CISSP, CISM or equivalent
• 7+ years of cybersecurity experience leading Security Operations Center (SOC)

Responsibilities

• Lead and coordinate cybersecurity incident investigations, including triage, analysis, validation, containment, eradication, recovery, and closure of security incidents.
• Serve as the primary incident commander working closely with management during major security events, coordinating activities between Security Operations, Infrastructure, Identity & Application teams.
• Develop, maintain, and improve incident response procedures, playbooks, runbooks, escalation processes, and detection methodologies.
• Lead post-incident reviews, root cause analysis activities, lessons learned sessions and recommend corrective actions to prevent recurrence.
• Communicate incident status, risks, and remediation activities to technical teams, management, executives, and external stakeholders.
• Provide mentoring and guidance to junior analysts, MSSP personnel, and incident response stakeholders regarding incident handling procedures and cyber threats.
• Produce incident metrics, reports, KPI dashboards, and executive summaries that measure CSIRT effectiveness and operational maturity.
• Lead continuous improvement initiatives across security monitoring and incident response functions by collaborating with Security Engineering teams to enhance detection coverage, automate response activities, improve security analytics, and drive operational metrics such as mean time to detect (MTTD), mean time to respond (MTTR), and overall incident response effectiveness.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior