Incident Response Lead

At Zelis, we Get Stuff Done. So, let’s get to it!

A Little About Us

Zelis is modernizing the healthcare financial experience across payers, providers, and healthcare consumers. We serve more than 725 payers, including the top five national health plans, regional health plans, TPAs and millions of healthcare providers and consumers across our platform of solutions. Zelis sees across the system to identify, optimize, and solve problems holistically with technology built by healthcare experts – driving real, measurable results for clients.

At Zelis, AI is woven into the fabric of how we work. Every associate is expected - and empowered - to partner with AI to challenge the status quo, accelerate innovation, and amplify their impact. This is a place for builders with a growth mindset who act with agility, embrace change, and use modern technology to shape smarter solutions, exceptional experiences, and the future of our industry for our clients, customers, and our culture.

A Little About You

You bring a unique blend of personality and professional expertise to your work, inspiring others with your passion and dedication. Your career is a testament to your diverse experiences, community involvement, and the valuable lessons you've learned along the way. You are more than just your resume; you are a reflection of your achievements, the knowledge you've gained, and the personal interests that shape who you are.

Position Overview

Incident Response Lead

As an Incident Response Lead, you’ll serve as a senior, hands-on technical lead responsible for investigating, containing, and responding to cybersecurity incidents across the organization. You’ll lead complex investigations, perform digital forensics and incident response (DFIR) analysis, and help coordinate response activities from initial detection through containment, eradication, recovery, and post-incident review.

This role combines deep technical expertise with incident leadership. You’ll analyze digital evidence, establish timelines and root cause, guide other analysts through complex investigations, and partner with teams across the organization to drive incidents toward resolution. You’ll also help strengthen our overall detection and response capabilities by improving processes, developing investigative techniques, sharing knowledge, and identifying opportunities for automation.

A component of this role will focus on Data Loss Prevention (DLP) and insider risk initiatives, including incident investigation, analysis, response, and development of processes and procedures in this space.

Key Responsibilities

• Incident Response Leadership: Lead cybersecurity incidents from initial identification and triage through investigation, containment, eradication, recovery, and post-incident activities. Provide technical direction during complex or high-severity incidents and help coordinate response activities across participating teams.
• Digital Forensics & Investigation: Perform hands-on forensic analysis of endpoints, systems, files, logs, cloud environments, network data, and other artifacts to determine scope, root cause, attack paths, timelines, and impact.
• Incident Analysis & Handling: Triage security alerts and escalations, investigate suspicious activity, develop investigative hypotheses, correlate evidence across multiple data sources, and determine appropriate response actions.
• DLP & Insider Risk: Investigate potential data loss and insider risk events, identify patterns of suspicious activity, and help develop and mature investigative and response processes for DLP and insider risk.
• Data Collection & Normalization: Ensure relevant security telemetry and forensic evidence are collected, preserved, normalized, and made available for effective investigation and analysis.
• Cross-Functional Incident Coordination: Partner with SOC, IT, Cloud, Engineering, Legal, Privacy, HR, and other appropriate teams to gather evidence, assess risk, and coordinate technical response actions.
• Mentoring & Training: Provide technical mentorship to analysts by sharing investigative techniques, reviewing complex cases, providing guidance, and conducting training or knowledge-sharing sessions.
• Technical & Process Guidance: Serve as an escalation point for complex investigations and provide guidance on security tooling, forensic techniques, investigative methodologies, and established incident response workflows.
• Operational Leadership: Help manage investigation priorities, monitor active incidents, ensure appropriate documentation and handoffs, and participate in a rotating on-call schedule as required.
• Incident Documentation & Post-Incident Review: Ensure significant incidents are appropriately documented, including investigative findings, timelines, root cause, impact, response actions, and lessons learned. Help identify and track opportunities to improve detection and response following incidents.
• Detection & Response Improvement: Identify gaps in telemetry, detections, tooling, processes, and response capabilities based on investigative findings and emerging threats.
• Innovation & Automation: Identify opportunities to improve investigative efficiency through new tools, scripting, automation, integrations, and process improvements.

What You Can Expect on a Typical Day

• Reviewing security alerts, logs, and telemetry to identify potential threats or suspicious activity.
• Leading or assisting with active security incidents and driving investigations toward containment and resolution.
• Performing forensic analysis on endpoints, cloud workloads, network artifacts, logs, and other evidence to establish scope, root cause, and incident timelines.
• Developing and testing investigative hypotheses using multiple security and forensic data sources.
• Coordinating technical response actions during complex or high-severity incidents.
• Investigating DLP and insider risk events and helping mature the processes used to handle these investigations.
• Collaborating with IT, Cloud, Engineering, and other security teams to collect evidence or execute containment and remediation actions.
• Serving as a technical escalation point and helping teammates work through difficult investigations.
• Documenting investigative findings, developing incident timelines, and communicating technical findings to both technical and non-technical stakeholders.
• Participating in post-incident reviews and identifying opportunities to improve controls, detections, telemetry, tooling, and response procedures.
• Sharing new investigative techniques, threat knowledge, or tooling capabilities with the broader team.
• Monitoring active investigations and helping prioritize incident response activities.
• Identifying opportunities for automation and other improvements that make investigations faster and more effective.
• Performing other tasks required by management as needed.

Qualifications

• 4+ years of hands-on Digital Forensics and Incident Response (DFIR), cybersecurity incident response, or equivalent enterprise security investigation experience.
• Demonstrated experience leading or serving as a senior technical responder during complex cybersecurity incidents.
• Hands-on experience investigating compromised endpoints, identities, cloud environments, network activity, or other enterprise security events.
• Experience performing forensic analysis and correlating evidence across multiple security data sources to establish incident scope, timelines, root cause, and impact.
• Strong understanding of the incident response lifecycle, including preparation, detection and analysis, containment, eradication, recovery, and post-incident activities.
• Working knowledge of common attacker techniques and the ability to apply investigative methodologies to identify malicious activity.
• Experience working with enterprise security technologies such as SIEM, EDR/XDR, SOAR, network security tooling, cloud security platforms, and forensic tools.
• Ability to partner effectively with enterprise teams in a cybersecurity context and coordinate technical activities during active investigations.
• Effective written and verbal communication skills, including the ability to document investigations and communicate technical findings to technical and non-technical stakeholders.
• Experience developing or improving cybersecurity processes, procedures, playbooks, or technical documentation.
• Demonstrated commitment to maintaining technical proficiency in incident response, digital forensics, threat analysis, and related cybersecurity disciplines.
• Ability to provide technical leadership and mentorship while remaining a hands-on contributor.
• Bachelor’s degree in Computer Science, Engineering, Information Security, Information Technology, or a related field, or equivalent professional experience.

Preferred Qualifications

• Advanced cybersecurity or DFIR certifications such as GCFA, GCIA, GNFA, GCTI, GREM, GCIH, GPEN, OSCP, or similar.
• Experience investigating DLP, insider risk, data exfiltration, or other data security incidents.
• Experience responding to incidents involving cloud environments such as AWS, Azure, or GCP.
• Cloud security or cloud platform certifications.
• Proficiency with scripting or programming languages such as Python, PowerShell, or Bash for investigation and response automation.
• Experience with SIEM, SOAR, EDR/XDR, malware sandboxing, forensic analysis platforms, and related security technologies.
• Familiarity with threat intelligence and frameworks such as MITRE ATT&CK and their application to incident investigation and response.

Please note at this time we are unable to proceed with candidates who require visa sponsorship now or in the future.

Location and Workplace Flexibility

Zelis is headquartered in the U.S., with multiple locations across the country and in Hyderabad, India. Check out our locations to learn more about our offices. All employee work locations are based on the needs of the position and are determined by the Leadership team. In-office work and activities vary based on work and team objectives in accordance with Company policies.

While location expectations vary by role, candidates within approximately 50 miles of a U.S. office are generally preferred to support collaboration when needed. Our hybrid approach is flexible, and in-office presence is guided by team and business needs rather than a fixed weekly schedule.

Base Salary Range

At Zelis we are committed to providing fair and equitable compensation packages. The base salary range allows us to make an offer that considers multiple individualized factors, including experience, education, qualifications, as well as job-related and industry-related knowledge and skills, etc. Base pay is just one part of our Total Rewards package, which may also include discretionary bonus plans, commissions, or other incentives depending on the role.

Zelis’ full-time associates are eligible for a highly competitive benefits package as well, which demonstrates our commitment to our employees’ health, well-being, and financial protection. The US-based benefits include a 401k plan with employer match, flexible paid time off, holidays, parental leaves, life and disability insurance, and health benefits including medical, dental, vision, and prescription drug coverage.

Equal Employment Opportunity
Zelis is proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.

We welcome applicants from all backgrounds and encourage you to apply even if you don’t meet 100% of the qualifications for the role. We believe in the value of diverse perspectives and experiences and are committed to building an inclusive workplace for all.

Accessibility Support
We are dedicated to ensuring our application process is accessible to all candidates. If you are a qualified individual with a disability or a disabled veteran and require a reasonable accommodation with any part of the application and/or interview process, please email TalentAcquisition@zelis.com.

Disclaimer

The above statements are intended to describe the general nature and level of work being performed by people assigned to this classification. They are not to be construed as an exhaustive list of all responsibilities, duties, and skills required of personnel so classified. All personnel may be required to perform duties outside of their normal responsibilities, duties, and skills from time to time.

About Us

Zelis is modernizing the healthcare financial experience across payers, providers, and healthcare consumers. We serve more than 725 payers, including the top five national health plans, regional health plans, TPAs and millions of healthcare providers and consumers across our platform of solutions. Zelis sees across the system to identify, optimize, and solve problems holistically with technology built by healthcare experts – driving real, measurable results for clients.

Zelis maintains a transparent, fee-free recruitment process. All genuine offers originate from our Talent Acquisition team using the “@zelis.com” domain. We do not use WhatsApp or personal emails for recruitment. Forward any suspected fraud to verify-offers@zelis.com for prompt investigation. Thank you for staying vigilant.