Log In
Sign Up
Job Summary :
The Iron Mountain Cyber Incident Response Team (CIRT) is responsible for detecting and investigating information security incidents across the global enterprise. The team coordinates with key stakeholders to gather incident details, assess the impact, and leads response and recovery efforts. The Cyber Incident Response Analyst IV is a full time remote position that reports to the CIRT Senior Director and will be responsible for leading the review of complex information security incidents from identification to incident resolution. The experienced candidate will have the opportunity to contribute to a highly visible information security function with accountability for managing internal and external security incidents as well as responsibility for enhancing the firm’s posture against evolving cyber security threats.
Requirements :
Security Alert Management/Threat Hunting
• Monitor and analyze network, host, cloud posture, identity, attack surface, intelligence, and email based security events and logs to identify potential security threats.
• Prioritize and differentiate between potential intrusion attempts, false alarms, and risks.
• Properly respond to alerts that require incident response review.
• Develop and tune threat detection policies, rules, and intelligence.
Incident Response
• Lead the management of complex information security incidents from triage through resolution.
• Ability to manage multiple investigations concurrently.
• Lead a cross-functional team of experts to resolve the incident investigation.
• Provide timely and relevant updates to appropriate stakeholders and decision makers.
• Conduct root cause analysis and partner with functional experts to determine the remediation path for incident resolution. Root cause analysis may include, but is not limited to malware analysis, computer forensic analysis, log analysis, personnel interviews, and technical troubleshooting. The CIRT Analyst III will evaluate controls at each level of security defense, from end-point to perimeter.
• Provide findings to relevant business leadership to help improve information security posture.
• Validate and maintain incident response plan and playbooks to address the evolving threat landscape.
• Create and maintain strong relationships with key partners in the incident response ecosystem and ensure efficient alignment during the investigation process.
• Compile and analyze data for management reporting and metrics.
• Provide rotational on-call support for assessing potentially critical alerts escalated by off-hours monitoring team.
Threat Management
• Manage and analyze threat intelligence data received from cyber threat vendors.
• Monitor information security related websites (e.g., US-CERT, SANS Internet Storm Center) and mailing lists (e.g., SANS NewsBites, etc.) to stay current on the latest malicious code trends, exploits, and malware.
• Participate in working groups that assess Iron Mountain’s risk posture.
• Analyze the potential impact of new threats and communicate risks to relevant business units.
• Develop advanced threat detection rules based on analysis of intelligence.
Experience & Qualifications :
• Ten or more years of technical experience in the information security field, preferably in a Security Operations Center (SOC), Network Operations Center (NOC), or Computer Emergency/Incident Response Team (CERT/CIRT)
• Eight or more years of practical Cyber Incident Management and Threat Hunting experience.
• Advanced knowledge of information systems security concepts and technologies, including SIEM technologies, network architecture, database concepts, intrusion detection, cloud security, endpoint detection and response ( EDR), email protection, malware remediation; and computer forensic tools such as EnCase and open source alternatives.
• Familiarity with security frameworks, such as NIST, and compliance standards such as HIPAA, GDPR, PCI, and FedRAMP.
• Strong understanding of incident, problem, and change management is preferred.
• Advanced knowledge and experience with the Windows and Linux operating systems.
• Working knowledge and experience with investigating malicious code.
• Demonstrated ability to apply technical and analytical skills in a security environment
• Ability to work extremely well under pressure while maintaining a professional image and approach
• Exceptional data analytics abilities; can perform independent analysis and distill relevant findings and root cause
• Strong analytical writing skills; can articulate complex ideas clearly and effectively; experience creating and presenting documentation and management reports
• Team player with proven ability to work effectively with other business units, IT management and staff, Legal, vendors, and consultants
• Strong communication skills; can plan and lead effective meetings, conduct structured interviews to collect information, and present to a variety of audiences, including key stakeholders and decision makers
• Experience in the following or similar tools: Chronicle Backstory,, Crowdstrike Falcon, Prisma Cloud, Check Point Next Generation Appliances, Tenable, Tanium, Google Cloud Platform, AWS, Azure.
• Working understanding of threat intelligence, SOAR, and attack surface platforms.
Education/Certifications
• Bachelor’s degree in information systems, computer science, or related discipline required.
• Postgraduate degrees and certificate programs in relevant areas that demonstrate analytical and technical background will also be considered.
• SANS certifications (GSEC, GCIH, GCFA, GCFR, or GCIA).
Category: Risk Management
Iron Mountain is a global leader in storage and information management services trusted by more than 225,000 organizations in 60 countries. We safeguard billions of our customers’ assets, including critical business information, highly sensitive data, and invaluable cultural and historic artifacts. Take a look at our history here .
Iron Mountain helps lower cost and risk, comply with regulations, recover from disaster, and enable digital and sustainable solutions, whether in information management, digital transformation, secure storage and destruction, data center operations, cloud services, or art storage and logistics. Please see our Values and Code of Ethics for a look at our principles and aspirations in elevating the power of our work together.
Requisition: J0076064
