Principal Cybersecurity Incident Responder

Stryker

. Lead the technical response to significant and complex cybersecurity incidents from initial investigation through containment, eradication, and recovery .

Posted 11/6/2026full-timeRemote • Michigan • United StatesLead💰 $135,600 - $293,700 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in leading technical responses to complex cybersecurity incidents, with a strong focus on incident response, digital forensics, and threat hunting. Proficient in developing incident response playbooks and coordinating cross-functional technical teams to enhance security operations.

Highest-signal resume keywords

Incident Response LeadershipCybersecurity Incident InvestigationDevelopment of Incident Response PlaybooksUnderstanding of Attacker TacticsCross-Functional Team Coordination

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident ResponseDigital ForensicsThreat HuntingSecurity OperationsCloud SecurityInvestigative TelemetryRisk-Based Decision MakingEvidence EvaluationAutomationOrchestration

Soft Skills

Clear CommunicationInfluencing Without AuthorityHigh-Pressure Decision Making

Tools & Technologies

Endpoint Security TechnologiesIdentity Security TechnologiesNetwork Security TechnologiesEmail Security TechnologiesEnterprise Security Technologies

Certifications & Qualifications

CISSPGCIHECIHOSIRGCFAGCFECHFICISMGSOC

Industry Keywords

CybersecurityIncident ResponseDigital ForensicsThreat HuntingSecurity EngineeringRansomwareMalwareData ExfiltrationCloud CompromiseLateral Movement

Tech Stack

Tools & technologies

CloudCyber Security

About the role

Key responsibilities & impact

Lead the technical response to significant and complex cybersecurity incidents from initial investigation through containment, eradication, and recovery
Establish technical priorities, maintain momentum, and make timely, risk-based decisions amid incomplete, conflicting, or rapidly changing information
Partner with Investigations, Detection Engineering, Security Engineering, CTI, Threat Hunting, Forensics, Security Operations, and other teams to determine incident scope and coordinate response actions
Apply knowledge of attacker tactics, techniques, and procedures to incidents involving identity compromise, ransomware, malware, cloud compromise, lateral movement, data exfiltration, and other advanced threats
Evaluate investigative findings, identify critical gaps, test hypotheses, and translate evidence into containment, eradication, and recovery strategies
Balance rapid containment with business impact, operational continuity, evidence preservation, and full incident-scope understanding
Develop and improve incident response playbooks, procedures, technical capabilities, exercises, telemetry, tooling, automation, and lessons-learned processes
Design and facilitate technical tabletop exercises and simulations
Identify telemetry, tooling, access, and visibility gaps and strengthen detection and response capabilities with technical teams
Leverage AI, automation, and orchestration with appropriate human oversight
Lead technical contributions to post-incident reviews and drive improvements across telemetry, detections, tooling, automation, procedures, and training
Serve as a senior technical resource and mentor across the cybersecurity organization

Requirements

What you’ll need

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Security, or a related field, or an equivalent combination of education and relevant professional experience
8+ years of relevant cybersecurity experience across incident response, digital forensics, threat hunting, security operations, security engineering, or related disciplines
Relevant industry certifications in incident response, digital forensics, security operations, cloud security, or related cybersecurity disciplines preferred
Demonstrated experience leading the technical response to significant or complex cybersecurity incidents involving multiple technical teams and stakeholders
Significant hands-on experience investigating and responding to a range of sophisticated cyberattacks
Strong understanding of modern attacker tactics, techniques, and procedures
Broad technical knowledge of endpoint, identity, network, cloud, email, and enterprise security technologies, including investigative telemetry
Demonstrated ability to evaluate evidence, test hypotheses, identify investigative gaps, and make sound decisions with incomplete or rapidly changing information
Experience developing or improving incident response playbooks, procedures, exercises, or operational capabilities
Ability to communicate complex technical situations clearly and concisely to technical responders, cybersecurity leadership, and non-technical stakeholders
Ability to coordinate and influence cross-functional technical teams without direct authority and operate effectively in a high-pressure, global environment
Preference for candidates located in Eastern or Central time zones
CISSP, GCIH, ECIH, OSIR, GCFA, GCFE, CHFI, CISM, or GSOC certifications preferred

Benefits

Comp & perks

Remote work flexibility
Travel opportunity (20%)