- Company Name
- Hyundai Capital America
- Job Title
- Cybersecurity Incident Responder
- Job Description
-
**Job Title**: Cybersecurity Incident Responder
**Role Summary**
Execute and lead the enterprise‑wide incident monitoring, threat detection, investigation, containment, eradication, and recovery functions within a Security Operations Center (SOC). Manage the full incident lifecycle, coordinate third‑party responders, develop and maintain playbooks and runbooks, and deliver post‑incident analysis and process improvements.
**Expectations**
- 5–7 years of progressive cybersecurity operations experience.
- Proven expertise in incident response, forensic analysis, SIEM/EDR telemetry, and cloud security.
- Demonstrated ability to manage third‑party SOC tools and vendors.
- Strong analytical, communication, and documentation skills.
**Key Responsibilities**
- Serve as lead responder for all security incidents; triage, investigate, and determine severity.
- Own identification, containment, eradication, recovery, and post‑incident review for each event.
- Perform forensic analysis on endpoint, log, and cloud data to establish root cause and impact.
- Develop, maintain, and execute incident response playbooks, runbooks, and SOPs.
- Coordinate with MSSP and external incident responders; validate escalation and response quality.
- Record accurate incident details, investigation notes, and remediation actions.
- Generate and analyze incident metrics and SOC KPIs (MTTD, MTTR, alert volume, escalation quality).
- Refine SIEM detection rules, analytics, and alert logic to reduce false positives.
- Leverage threat intelligence to create actionable detection use cases.
- Implement automation and enrichment for faster triage and containment.
- Ensure log visibility and telemetry coverage with architecture and engineering teams.
- Collaborate with IT Infrastructure, IAM, DLP, Application Security, and Cloud teams during incidents.
- Support vulnerability management, migration planning, and security input for new initiatives.
**Required Skills**
- Incident response lifecycle management.
- Forensic analysis of endpoints, logs, and cloud environments.
- SIEM, EDR, log management, and threat intelligence platform proficiency.
- Development and tuning of detection rules, signatures, and alert logic.
- Automation (SOAR, scripts).
- Documentation and reporting (playbooks, post‑incident reports, metrics).
- Vendor/multi‑team coordination.
- Strong communication, analytical problem‑solving, and decision‑making skills.
**Required Education & Certifications**
- Bachelor’s degree in Computer Science, Information Security, or related field.
- Professional certifications such as CISSP, CISM, GIAC Security Incident Response from GIAC (GCIH, GCFA), or equivalent.
- Knowledge of relevant SOC standards (ISO 27001, NIST SP 800‑61) and regulatory requirements.