Sr. Staff Security Analyst- Incident Commander

UKG • ,

111d • $145,600 - $209,300

About The Position

As a Senior Staff Security Analyst - Incident Commander, you will be part of UKG’s Global Security Operations team, which detects, investigates, responds to, and leads containment of sophisticated cyber threats and major security incidents. You will use forensic techniques, threat hunting methods, security tools, and incident command practices to investigate, respond to, and drive resolution for threats affecting UKG and/or its customers.

Requirements

• Ability to lead complex security incidents, guide technical teams, influence response direction, and support strategic and technical SOC initiatives.
• 5+ years of direct, hands-on digital forensics and incident response experience supporting major enterprise environments.
• Advanced knowledge of forensic artifact areas across network, cloud, Windows, Linux, endpoint, identity, and runtime environments.
• Demonstrated experience leading or supporting major cyber incident command, including technical coordination, action tracking, decision support, stakeholder updates, and post-incident improvement activities.
• Deep hands-on experience performing endpoint disk, memory, cloud, and host-based forensic analysis in active incident response scenarios.
• Demonstrated hands-on threat hunting experience using SIEM, EDR, cloud telemetry, identity logs, network data, and forensic artifacts.
• Experience applying GenAI-assisted workflows to investigation, summarization, hunt development, scripting, or analyst enablement, while maintaining technical validation and judgment.
• Ability to lead, mentor, train, and influence technical analysts during investigations, hunting activities, and operational readiness efforts.
• Hands-on scripting skills in Python, PowerShell, Bash, or a similar language for investigation, automation, parsing, enrichment, and response workflows.
• Strong understanding of SOC operations, the incident response lifecycle, forensic collection standards, evidence handling, investigation documentation, and executive-ready incident reporting.
• Ability to develop practical training content for incident command, digital forensics, incident response, and threat hunting programs.
• Experience with at least one major public cloud service provider environment.
• Hands-on investigative analysis with one or more major SIEM, EDR, SOAR, cloud security, case management, and forensic tooling platforms.

Nice To Haves

• Reverse engineering and malware analysis experience, including static or dynamic triage of malware, scripts, payloads, or attacker tooling.

Responsibilities

• Provide hands-on digital forensics and incident response expertise across endpoint disk, memory, network, cloud, Windows, Linux, and runtime environments.
• Lead major cyber incident command activities by coordinating technical response, guiding investigative workstreams, tracking actions, briefing stakeholders, and driving incidents through containment and recovery.
• Perform hands-on threat hunting, with and without GenAI assistance, across SIEM, EDR, cloud, identity, network, and forensic data sources.
• Support and lead complex incident investigations as a technical contributor and collaborator with Security Operations Center, Threat Intelligence, Detection Engineering, Cloud Security, Infrastructure, Legal, Privacy, and business stakeholder teams.
• Guide, mentor, and train analysts during active incidents, post-incident reviews, tabletop exercises, and proactive hunting engagements.
• Create and present incident strategies, investigation plans, findings, timelines, and technical summaries to technical and executive leadership audiences when asked.
• Develop and maintain training materials, playbooks, procedures, and practical exercises for incident command, digital forensics, incident response, and threat hunting.
• Use mid-level scripting and automation to accelerate investigations, enrich forensic analysis, standardize response actions, and improve repeatability across the SOC.
• Support continuous improvement of incident handling processes, forensic collection methods, threat hunting tradecraft, and analyst readiness.
• Partner with Detection Engineering and Threat Intelligence teams to turn investigative findings into durable detections, response logic, hunting hypotheses, and operational improvements.
• Support reverse engineering or malware analysis as needed, including triage of suspicious binaries, scripts, payloads, and attacker tooling where skills apply.

Benefits

• Employees may be eligible to participate in a performance-based bonus plan.
• Employees may be eligible to receive restricted stock unit awards as part of total compensation.
• UKG promotes flexibility and offers benefits and rewards; specific benefits are not listed in the posting.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed