Incident Response Lead

ZS is a professional services firm that works side by side with companies to help develop and deliver products that drive customer value and company results. From R&D to portfolio strategy, customer insights, marketing and sales strategy, operations and technology, we leverage our deep industry expertise and leading-edge analytics to create solutions that work in the real world. Our most valuable asset is our people—a fact that’s reflected in our values-driven organization in which new perspectives are integral and new ideas are celebrated. ZSers are passionately committed to helping companies and their customers thrive in industries ranging from healthcare and life sciences, to high-tech, financial services, travel and transportation, and beyond. ZS’s Corporate Enterprise Functions operate the firm’s core internal functions. Our global teams comprise team-oriented, pragmatic and results-driven people who thrive in a challenging work environment. Our people come from diverse backgrounds but share a passion for quality customer service and dedication—whether our customer is a client or another ZS employee The Incident Response Lead will be located in our Evanston, IL office, and be primarily responsible for building and leading our Digital Forensics and Incident Response team and capabilities. The successful candidate will be responsible for overseeing our incident response tools and processes, covering proactive planning and prevention, as well as reactive detection and remediation. They will build and oversee a team of Incident Responders to ensure that all incidents will be investigated and closed following industry best-practices. Additionally, the Information Security Lead - DFIR will oversee continuous improvement efforts for the Incident Response capability. He/she will drive the critical steps of the incident response, and apply learnings toward our ability to be increasingly proactive in the future. The role of the lead position requires that the individual must have existing experience as an Incident Commander, leading a team of Incident Coordinators through incidents of varying criticality. In addition, they must have people management skills, and have extensive experience in working with Splunk or other industry renowned SIEM tool. The position requires in-depth knowledge of security concepts such as cyber-attacks and techniques, threat vectors, risk management, incident management etc. This individual would be expected to work with senior technical leaders of the organization and provide reports on existing threats, mitigation efforts, status of new project efforts and formulate a dashboard with daily insight into these areas and/or other information that would be relevant to provide new insights into the threat landscape. This role would also require understanding and experience in working on security for cloud services (AWS, Azure, GCP and/or other cloud solutions). Responsibilities Build and manage a global Digital Forensics and Incident Response team Own the critical process steps – detection, validation, containment, remediation, and communication – for computer-based security events and incidents such as malware infections, potential compromise, Distributed Denial of Service (DDoS), etc. Assists with training and mentoring of team members in Response and Forensics and ensures essential procedures are followed by the team Perform technical analysis of multiple sources of data, including network flows/packet data, host forensic artifacts, and application/system logs Build a continuous loop to oversee and improve existing processes. Make automation a mindset of the team to improve response, analysis, quality, and workload efficiency. Build a strong understanding of the ZS landscape to recognize urgency, impact, and map out correlations of different threats. Perform threat management, threat modeling, threat hunting, identify threat vectors and develop use cases for security monitoring. Provide regular briefings to stakeholders and leadership. Review the existing SOPs & technical runbooks & also create new SOP documents/runbooks for innovative technologies/process Create reports, dashboards and metrics for Incident Response operations and present to senior management. Other duties as assigned. Qualifications Bachelor’s Degree in Information Technology, or any other related field. 5-7 years' experience as an Incident Response Lead or equivalent knowledge. Strong expertise working with Splunk Enterprise Security, Security Essentials, and User Behavior Analytics. Recognized as a subject matter expert in IR with a deep understanding of real-world APT tactics, techniques, and procedures. Must be able to quickly determine if cases are criminal, commodity malware, or advanced persistent cases and chart the course of the team’s response as appropriate for each type of case Demonstrated history of leading teams of IR teams to successfully investigate cases of advanced targeted exploitation or similar interactive hacking cases Cloud SaaS and PaaS experience and an understanding of investigations in those environments and leveraging cloud for investigation scale High level of knowledge of various security methodologies, processes and technical security solutions. Strong knowledge of Firewalls/NGFW; IDS/IPS Strong knowledge of Next Generation AV tools (like CrowdStrike, Cylance or any NGAV/EDR); Encryption tools (like Symantec PGP, MBAM, etc.); Application Whitelisting and DLP tools. Strong Knowledge in Industry standard VAPT tools like Nessus, Rapid7 and opensource tools. Knowledge of open-source security monitoring tools. Expertise in working with various monitoring tools (like Athena, HP Open View, Nagios, SolarWinds, etc.). Understanding and experience working with cloud security services (AWS, Azure, GCP; others a plus) Managing a team to have strong research and highly analytical skills, especially with respect to event classification, event correlation, and root cause analysis. Must be a team leader, dedicated, and proactive. Must possess excellent communication, problem-solving, critical thinking and organizational skills. Must have strong presentation skills. Ability to clearly present technical approaches or findings in oral and written format. Ability to present ideas in business-friendly and user-friendly language. Highly self-motivated and directed. Candidate should be flexible to work in late shifts to converse with leadership teams in US as needed Preferred Certifications: GCFA, GCFE, GNFA, GREM, GCIH or equivalent certification preferred. Splunk Enterprise Security Certified Admin, CEH, ECSA, CISA, AWS Solution Architect also desirable. ZS is a global consulting firm. Fluency in English is required; additional fluency in at least one European or Asian language is desirable. Candidates must possess or be able to obtain work authorization for their intended country of employment. An on-line application, including a full set of transcripts (official or unofficial), is required to be considered. ZS offers a competitive compensation package with salary and bonus incentives, complete medical/dental/life insurance programs and retirement savings benefits. ZS is an equal opportunity employer and is committed to providing equal employment and advancement opportunities without regard to any class protected by applicable law. ZS is committed to providing and maintaining a safe workplace. Must have received or be willing to receive the COVID-19 vaccination by date of hire to be considered. Proof of vaccination will be required. Religious/Medical Exemptions can be requested on a limited basis upon hire. NO AGENCY CALLS, PLEASE.