Job Summary

As an Incident Response Specialist, you will leverage your extensive expertise in digital forensics, incident handling, and crisis management to lead the containment, mitigation, and resolution of advanced security incidents across the organization's enterprise environment. This role is responsible for the end-to-end lifecycle of security incidents, including coordinating cross-functional response efforts, performing deep-dive forensic analysis, and engineering strategic containment strategies to minimize business impact.

You will serve as a technical leader with deep hands on proficiency in host, network, and cloud forensics, applying incident response best practices to drastically reduce mean time to respond and remediate. This role requires exceptional analytical, problem-solving, and decisive communication skills, allowing you to translate complex technical findings into actionable remediation plans for executive leadership. You will work closely with Detection Engineering, Threat Intelligence, and key partners across the organization to ensure an integrated, proactive defense. You are expected to work independently with minimal supervision, take ownership of security incidents, and provide technical mentorship and training to team members. You will play a key role in shaping the organization's incident response strategy, execution of tabletop exercises, ensure operational resiliency, and the continuous hardening the organization's overall security posture.

Essential Functions

Perform advanced digital forensics and incident analysis, including host, network, memory, and log analysis, to determine the root cause, scope, and impact of security breaches.

Act as the primary technical incident commander during major security events, coordinating cross-functional teams, communication channels, and executive updates.

Develop, govern, and continuously optimize incident response playbooks, runbooks, and tabletop simulation exercises to ensure organizational readiness.

Collaborate with the Detection Engineering, Threat Intelligence, and organization stakeholders to translate post-incident findings into proactive detection rules and monitoring controls.

Author detailed incident post-mortem reports and root-cause analysis documentation for technical teams and executive leadership.

Conduct post-incident reviews to identify control gaps, procedural bottlenecks, and security weaknesses, translating lessons learned into strategic remediation projects.

Maintain comprehensive documentation of incident timelines, evidence custody chains, response activities, and compliance metrics.

Maintain comprehensive documentation of processes and activities.

Provide technical leadership, guidance, and mentorship to junior and senior incident response analysts and SOC team members.

Stay abreast of emerging threat actor tactics, techniques, and procedures (TTPs) and regulatory reporting requirements to ensure incident handling processes remain cutting-edge and compliant.

Qualifications

H.S. Diploma or GED required

Associate Degree or Bachelor's Degree in Cyber Security, Computer Science, Information Systems, or related field preferred

5+ years of IT or Information Security experience, including 3+ years in Digital Forensics and Incident Response

Familiarity with MITRE ATT&CK, Cyber Kill Chain, and other threat modeling frameworks preferred

Experience in scripting, automation (e.g., Python, PowerShell), and AI for security operations preferred

Knowledge, Skills and Abilities

Deep knowledge of typical IT platforms, operating systems, and configuration methods

Deep knowledge of security threat tactics, techniques, and procedures (TTPs), incident response methodologies, and detection techniques

Extensive experience with detection technologies (e.g., IDS/IPS, SIEM) and threat detection practices

Industry recognized cyber security training or certifications to include SANS, ISC2, EC-Council or CompTIA vendors

Equal Employment Opportunity

This organization does not discriminate in any way to deprive any person of employment opportunities or otherwise adversely affect the status of any employee because of race, color, religion, sex, sexual orientation, genetic information, gender identity, national origin, age, disability, citizenship, veteran status, or military or uniformed services, in accordance with all applicable governmental laws and regulations. In addition, the facility complies with all applicable federal, state and local laws governing nondiscrimination in employment. This applies to all terms and conditions of employment including, but not limited to: hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training. If you are an applicant with a mental or physical disability who needs a reasonable accommodation for any part of the application or hiring process, contact the director of Human Resources at the facility to which you are seeking employment; Simply go to http://www.chs.net/serving-communities/locations/ to obtain the main telephone number of the facility and ask for Human Resources.

Community Health Systems

New Jobs

DFIR Specialist, Cyber Security Risk Management (Remote)