Incident Response Analyst

• Coordinate assigned workstreams on cyber incident response, data breach and sensitive data matters
• Track tasks, deadlines, dependencies and deliverables against project plans
• Serve as a day-to-day point of contact for case teams, clients and vendors
• Confirm instructions, relay requests and follow up on open items
• Maintain project trackers, matter documentation, workflow notes and handoff materials
• Prepare status updates, metrics, validation summaries, draft reports and project communications
• Help Project Managers monitor scope, data volumes, hours and vendor activity
• Flag potential schedule or budget impacts early
• Follow procedures for data intake, transfer, tracking, preservation, chain of custody documentation and secure handling of sensitive information
• Analyze, manage and reconcile project data using Excel, Power Query, SQL, Python, PowerShell or similar tools
• Use search, analytics, regular expressions and data mining techniques to identify and report on PII, PHI, PCI and other sensitive or regulated data
• Support review-platform workflows including workspace setup, searches, batching or sampling, coding fields, exports, metrics and quality control
• Validate outputs for accuracy, completeness and defensibility
• Identify project, workflow, data or evidence-handling issues and escalate risks or unresolved questions
• Contribute reusable scripts, templates, trackers, validation checklists and process improvements

Senior Analyst, Cyber Incident Response

• Provide first-line support for incidents and technical issues reported by client staff and customers
• Categorize and escalate incidents according to severity and Standard Operating Procedures (SOPs)
• Escalate cases to specialized teams such as Threat Hunting and Vulnerability Management
• Coordinate with regional teams, private-sector entities, and partners throughout the incident lifecycle
• Track and verify distribution and resolution of service requests
• Maintain shared mailboxes, incoming incident reports, and phone systems for efficient case routing and response
• Perform correlation analysis across cyber, physical, and communication threats
• Contribute to daily, weekly, and monthly reports on emerging threat patterns and operational metrics
• Deliver customer service and technical support to client partners during incident responses
• Participate in shift synchronization meetings to support seamless 24/7 Operations Center transitions
• Perform other duties as assigned

Junior Cyber Incident Response Analyst

• Lead cybersecurity investigations associated with escalated security incidents and suspicious activity
• Serve as Lead Investigator (Handler) for assigned escalated cybersecurity incidents
• Coordinate and oversee investigative, containment, eradication, and recovery activities for major cybersecurity events
• Conduct major and micro-hunt investigations to identify malicious activity, assess risk, and improve detection capabilities
• Investigate threats, exploits, vulnerabilities, malware families, and advanced adversary activity across enterprise environments
• Perform advanced host, network, log, cloud, and threat intelligence analysis
• Produce technical reports, after-action reviews, executive summaries, and leadership briefings
• Collaborate with Security Operations, Threat Intelligence, Digital Forensics, Malware Analysis, Engineering, Legal, Privacy, and other stakeholders
• Support development and continuous improvement of incident response playbooks, processes, automation, and investigative methodologies
• Design and facilitate tabletop exercises and cybersecurity incident simulations
• Identify security control gaps and recommend improvements to organizational resilience
• Mentor analysts and investigators across the Incident Response organization
• Provide executive-level communications during significant cybersecurity events
• Support investigations involving endpoint systems, cloud environments, identity platforms, network infrastructure, telecommunications systems, applications, and emerging technologies
• Participate in an on-call rotation supporting critical cybersecurity events

Principal Cybersecurity – Incident Response Analyst

• Process investigation requests from SOC Analysts monitoring security events through SIEM across network and host-based IDS/IPS, network infrastructure logs, system logs, applications, and databases
• Investigate intrusion attempts, distinguish false positives from true intrusions, and perform in-depth exploit analysis
• Lead incident response and threat hunting for confirmed High Priority security incidents through resolution
• Use threat intelligence to identify and investigate potential security threats
• Develop incident response and incident management playbooks covering threat triage, investigation, and resolution
• Review and update playbooks for currency and effectiveness
• Collaborate with cross-functional teams to align playbooks with security strategy and goals
• Participate in tabletop exercises and drills to test and validate playbooks
• Monitor and evaluate incidents to identify playbook improvement opportunities
• Track current security threats and trends to keep playbooks relevant
• Investigate current vulnerabilities, advisories, incidents, and TTPs and collaborate with Security Engineering on recommended use cases
• Proactively monitor, hunt, and respond to known and emerging threats
• Execute Thrive’s information security strategy internally and externally for 400+ clients
• Analyze data from SOC, SIEM, and EDR platforms and determine whether further analysis is needed
• Follow Thrive security standards and best practices and recommend enhancements
• Stay current on security events and techniques to protect clients