Principal, Cybersecurity Incident Responder

Stryker•Kalamazoo, MI

2d•Remote

About The Position

The Principal Cybersecurity Incident Responder is a senior technical cybersecurity leader responsible for directing responses to significant and complex cybersecurity incidents. The role establishes technical priorities, leads investigations, and guides incidents through containment, eradication, and recovery, making timely, risk-based decisions in complex and rapidly changing situations. During significant incidents, the responder serves as Technical Response Lead and works with cybersecurity specialists across investigations, detection engineering, security engineering, cyber threat intelligence, threat hunting, forensics, and security operations. Outside active incidents, the role strengthens response readiness by improving playbooks, exercises, telemetry, tooling, automation, and lessons-learned processes, including identifying appropriate opportunities to use AI. The position is remote. Preference is given to candidates in Eastern or Central time zones to support collaboration during core business hours. Travel is 20%.

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Security, or a related field, or an equivalent combination of education and relevant professional experience.
At least 8 years of relevant cybersecurity experience in incident response, digital forensics, threat hunting, security operations, security engineering, or related disciplines.
Demonstrated experience leading technical responses to significant or complex cybersecurity incidents involving multiple technical teams and stakeholders.
Significant hands-on experience investigating and responding to sophisticated cyberattacks.
Strong understanding of modern attacker tactics, techniques, and procedures and the ability to apply that knowledge during active incidents.
Broad technical knowledge of endpoint, identity, network, cloud, email, and enterprise security technologies, including telemetry used to investigate attacks across these environments.
Ability to evaluate evidence, test hypotheses, identify investigative gaps, and make sound decisions with incomplete or rapidly changing information.
Experience developing or improving incident response playbooks, procedures, exercises, or operational capabilities.
Ability to communicate complex technical situations clearly and concisely to technical responders, cybersecurity leadership, and non-technical stakeholders.
Ability to coordinate and influence cross-functional technical teams without direct authority and work effectively in a high-pressure, global environment.

Nice To Haves

Relevant industry certifications in incident response, digital forensics, security operations, cloud security, or related cybersecurity disciplines are preferred.
CISSP certification preferred.
GCIH certification preferred.
Other relevant incident response certification, such as ECIH or OSIR.
Digital forensics certification, such as GCFA, GCFE, or CHFI.
CISM.
GSOC.

Responsibilities

Lead technical responses to significant and complex cybersecurity incidents from initial investigation through containment, eradication, and recovery.
Set technical priorities, maintain response momentum, and make timely, risk-based decisions when information is incomplete, conflicting, or changing rapidly.
Coordinate with investigations, detection engineering, security engineering, cyber threat intelligence, threat hunting, forensics, security operations, and other teams to determine incident scope and response actions.
Apply knowledge of attacker tactics, techniques, and procedures to incidents involving identity compromise, ransomware, malware, cloud compromise, lateral movement, data exfiltration, and other advanced threats.
Evaluate investigative findings, identify critical gaps, test hypotheses, and translate evidence into containment, eradication, and recovery strategies.
Balance rapid containment with business impact, operational continuity, evidence preservation, and the need to understand incident scope.
Develop and improve incident response playbooks, procedures, and technical capabilities based on incidents, exercises, emerging threats, and lessons learned.
Design and facilitate technical tabletop exercises and simulations to validate response capabilities and identify improvements.
Identify telemetry, tooling, access, and visibility gaps, and partner with technical teams to strengthen detection and response capabilities.
Use AI, automation, and orchestration where appropriate to accelerate investigation and response while maintaining human oversight.
Lead technical contributions to post-incident reviews and drive improvements to telemetry, detections, tooling, automation, procedures, and training.
Serve as a senior technical resource and mentor to strengthen incident response capabilities and decision-making across the cybersecurity organization.