Principal Incident Response Analyst

Principal Incident Response Analyst
North - Remote
The Principal Incident Response Analyst is a seasoned, deeply experienced incident response expert who runs North’s most complex security incidents from detection through recovery, without supervision.
Incident response is the primary area of expertise for this role, complemented by strong secondary expertise in detection engineering and tertiary expertise in threat hunting. The Principal Incident Response Analyst serves as the top escalation point for security incidents, sets the technical standard for how the organization investigates and contains threats, and mentors other engineers and analysts on incident handling practice. This role works closely with the SOC, IT, and engineering teams, and represents the deepest incident response expertise on the security team, operating across our payment processing environment.
What You'll do:
Incident Response
Serve as the principal escalation point and lead investigator for the most complex, highest-severity, and novel security incidents, running them end to end without supervision
Independently triage, investigate, contain, eradicate, and recover from security incidents spanning endpoint, network, cloud, identity, and application layers
Lead full-scope forensic investigations of compromised hosts, accounts, applications, and cloud infrastructure, and reconstruct complete attack timelines from initial access through impact
Translate complex investigation findings into clear narratives for engineering teams and clear executive-level narratives for leadership
Own and continuously evolve incident response process, documentation, and playbooks, incorporating lessons learned from real incidents
Lead root cause analysis and structured post-incident reviews, and drive cross-team remediation of systemic gaps
Serve as the senior technical lead during major incidents, coordinating across IT, legal, compliance, and executive leadership as needed
Provide case-level guidance and mentorship to other incident responders and SOC analysts during live incidents
Participate in or lead on-call rotation for critical incident response as needed
Detection Engineering
Translate incident findings and root cause analysis directly into new or improved detection logic, closing the loop between investigation and prevention
Write, tune, and validate detection content in the SIEM/NG-SIEM platform, focused on techniques observed in real investigations and threat hunts
Maintain and improve coverage and gap analysis against the MITRE ATT&CK framework, informed by incident and hunt findings
Review detection logic for accuracy and false-positive rate, and partner with the detection engineering team on rule quality
Contribute documentation of known coverage and detection gaps surfaced through incident response and hunting work
Threat Hunting
Conduct proactive, hypothesis-driven threat hunts based on incident trends, emerging adversary TTPs, and threat intelligence
Use hunt outcomes to surface undetected compromises, validate detection coverage, and strengthen incident response readiness
Prioritize hunts against the techniques and attack paths most relevant to a payments/fintech environment
Partner with threat intelligence sources and feeds to inform hunt hypotheses and target selection
Document hunt methodology, findings, and follow-on actions, including new detections and updated incident response playbook material
Cross-Functional & Leadership
Represent incident response in cross-org planning, tabletop exercises, and architecture reviews
Lead complex, ambiguous incident-related investigations and initiatives independently from scoping through delivery
Mentor other engineers and analysts on incident response, detection engineering, and threat hunting practices
Partner with cloud, network, and identity teams to close visibility and telemetry gaps identified during incidents and hunts
Stay current on threat intelligence, adversary TTPs, and vulnerabilities relevant to a payments/fintech environment
Communicate findings, coverage gaps, and recommendations clearly to both technical and non-technical stakeholders, including leadership
Develop and maintain procedure and policy documentation supporting incident response operations
What we need from you:
Bachelor's degree in a technical field, or equivalent professional experience
7+ years of hands-on information security experience, with deep, demonstrated subject-matter expertise in incident response, and strong working proficiency in detection engineering and threat hunting
Demonstrated track record independently leading complex, high-severity security incidents from detection through recovery, without supervision
Experience mentoring or providing technical leadership to other security engineers and analysts
Excellent written and verbal communication skills, including the ability to translate technical findings for non-technical stakeholders and leadership, including during active incidents
Deep, hands-on expertise leading end-to-end incident response (triage, containment, eradication, recovery, and root cause analysis) on complex or novel incidents, independently
Advanced digital forensics skills across endpoint, network, cloud, and identity sources, including memory and disk forensics
Advanced experience with EDR/XDR platforms and log analysis across diverse sources: endpoint, network, cloud, and identity
Strong working knowledge of detection engineering: writing, tuning, and validating detection content in a SIEM or NG-SIEM platform (e.g., CrowdStrike NG-SIEM, Splunk, Microsoft Sentinel)
Working proficiency in hypothesis-driven threat hunting methodology, informed by threat intelligence and the MITRE ATT&CK framework
Deep working knowledge of the MITRE ATT&CK framework and its practical application to incident response, detection gap analysis, and hunt prioritization
Strong scripting or automation experience (Python, PowerShell, or similar) applied to security use cases AND/OR experience using LLM coding tools such as Claude Code, Gemini CLI, or Codex
Solid understanding of networking, cloud infrastructure (AWS especially, but also Azure and GCP), Windows/Linux systems, and identity platforms
Working knowledge of PCI-DSS or a comparable compliance framework