Senior Cybersecurity Incident Handler

General Motors

. Investigate, coordinate, and resolve cybersecurity incidents across the enterprise .

Posted 10/17/2026full-timeUnited StatesSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in incident triage, evidence collection, and endpoint investigation, with a strong focus on utilizing CrowdStrike Falcon and Next-Gen SIEM for effective cybersecurity incident management. Proficient in developing secure automation and workflows to enhance operational efficiency and response capabilities.

Highest-signal resume keywords

Incident TriageCrowdStrike Falcon AdministrationPython DevelopmentWindows Live-Response DesignNext-Gen SIEM Correlation Rules

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident TriageEvidence CollectionEndpoint InvestigationContainmentRemediationPython DevelopmentYARA ScanningWorkflow AutomationMulti-Environment CI/CD DeploymentTechnical Documentation

Soft Skills

CollaborationMentoringKnowledge Sharing

Tools & Technologies

CrowdStrike FalconNext-Gen SIEMGitHubSlackMISPSguilVelociraptorIT AutomationLive-Response ToolingDashboards

Industry Keywords

CybersecurityIncident ResponseOperational RecoveryForensic CollectionRegulated Environments

Tech Stack

Tools & technologies

Cyber SecurityPython

About the role

Key responsibilities & impact

Investigate, coordinate, and resolve cybersecurity incidents across the enterprise
Triage security alerts and incidents involving endpoints, identities, malware, suspicious processes, persistence mechanisms, network activity, and potential data exposure
Develop investigative plans, gather and preserve evidence, analyze endpoint telemetry and live-response results, and document findings
Perform or coordinate approved containment, eradication, and remediation actions, including host isolation, live response, file retrieval or removal, directory cleanup, and scheduled-task removal
Use CrowdStrike Falcon, Next-Gen SIEM, live-response tooling, IT Automation, and other security platforms
Coordinate incident activities with Response, Detect, Endpoint, Engineering, Insider Threat, Threat Intelligence, and other stakeholders
Assess incident severity, business impact, scope, and risk; escalate appropriately and provide status updates
Identify indicators of compromise and investigative leads; collaborate with detection and intelligence teams to improve correlation rules, threat hunting, and monitoring coverage
Create accurate incident documentation, including timelines, investigative actions, evidence, containment decisions, root-cause findings, and lessons learned
Maintain response playbooks, wiki content, workflow documentation, and operational procedures
Develop secure automation, scripts, dashboards, integrations, and workflows to improve responder efficiency
Test response capabilities, validate safeguards and permissions, and support deployment across development, test, and production environments
Participate in incident reviews, process improvement, mentoring, and knowledge-sharing across Security Operations

Requirements

What you’ll need

Incident triage, scoping, evidence collection, endpoint investigation, containment, remediation, and operational recovery
Windows live-response design and deployment, including multi-host workflows, timeout handling, YARA scanning, file retrieval, and file removal
CrowdStrike Falcon administration and engineering across Fusion Workflows, IT Automation, Next-Gen SIEM, custom IOA rules, lookup files, detections, APIs, and endpoint response
Design of workflows for directory removal, scheduled-task removal, live-response deployment, file operations, host-online notification, detection auto-closure, host containment, and BitLocker recovery actions
CrowdStrike integrations with Slack, MISP, Sguil, GitHub, and other operational tools
Experience developing correlation rules, including real-time NGSIEM rules and rules supporting suspected DPRK activity investigations
Python development for security exports, command-line utilities, API integrations, data transformation, and operational services
GitHub repository design, pull-request-based delivery, GitHub Actions, GitHub Pages, workflow automation, and cross-repository synchronization
Multi-environment CI/CD deployment for CrowdStrike and Velociraptor capabilities
Architecture of MISP-to-CrowdStrike IOC integration for Intel and Detect
Migration and recovery of more than 80 Next-Gen SIEM correlation rules
Strong technical documentation skills covering deployment, single-host and multi-host use, timeout configuration, troubleshooting, and operational procedures
GM does not provide immigration-related sponsorship; candidates must not require GM immigration sponsorship now or in the future
Preferred: experience with Velociraptor or comparable endpoint live-response platforms
Preferred: experience with YARA, endpoint telemetry, host artifacts, and forensic collection workflows
Preferred: experience integrating MISP, CrowdStrike, Slack, Confluence, GitHub, Sguil, Databricks, or comparable enterprise security platforms
Preferred: experience supporting regulated or highly governed enterprise environments
Preferred: experience contributing to open-source security or infrastructure tooling
Preferred: experience migrating documentation or operational content between wiki platforms
Preferred: experience designing secure automation with role-based access, audit trails, approval controls, and rollback considerations

Benefits

Comp & perks

Relocation benefits are available for candidates who qualify under company policy
Benefits supporting well-being at work and at home through GM Total Rewards resources
Reasonable accommodations for applicants with disabilities