Incident Response Specialist

Primary Details

Time Type: Full time

Worker Type: Employee

Title: Incident Response Specialist

The Opportunity The purpose of this role is to lead and coordinate the organization's response to cybersecurity incidents through proactive and reactive security operations. This role conducts advanced analysis of cyber threats, investigates security events, performs threat hunting and forensic analysis, and provides effective technical responses to cybersecurity incidents to protect the organization against evolving threats. The position also serves as a trusted advisor on incident response capabilities, cybersecurity risk management, and continuous improvement initiatives that strengthen organizational resilience

Location: Madison, WI United states
Work Arrangement: This role is hybrid, requiring 3 days/week in our Madison, WI office
The salary range for this role is between $93,000-$135,000

Your New Role

• Lead and coordinate the response to cybersecurity incidents including detection, analysis, containment, eradication, recovery, and post-incident activities.
• Conduct detailed investigations of security events and incidents to determine root cause, scope, impact, and remediation requirements.
• Monitor, analyze, and triage security alerts from multiple security platforms to identify malicious activity and escalate incidents appropriately.
• Communicate incident status, risks, and remediation recommendations effectively to both technical and non-technical stakeholders, including leadership teams.
• Perform threat hunting and forensic analysis activities to identify adversary tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), and potential security gaps.
• Develop, maintain, and execute incident response playbooks, procedures, and runbooks aligned with industry frameworks and best practices.
• Coordinate cross-functional response activities with internal teams, third-party vendors, managed service providers, and business stakeholders during cybersecurity incidents.
• Leverage threat intelligence sources and partner intelligence feeds to enrich investigations, identify emerging threats, and improve detection and response capabilities.
• Collect, analyze, and document incident data, trends, and metrics to support continuous improvement of security controls, processes, and detection capabilities.
• Assist in the development, testing, and maintenance of the Cybersecurity Incident Management Plan and cyber crisis response capabilities.
• Support the implementation of defense-in-depth strategies and security controls to reduce organizational risk and improve detection and response effectiveness.
• Identify and assess cybersecurity risks within assigned areas of responsibility, act as a subject matter expert, and provide risk-based recommendations to support informed decision-making.

Required Qualifications

• Tertiary Degree or equivalent combination of education and work experience.

Preferred Qualifications

• Relevant cybersecurity certifications such as GCIH, GCFA, GCFE, CISSP, CySA+, Security+, or equivalent.

Required Work Experience

• Experience in cybersecurity, incident response, security operations, digital forensics, threat hunting, or a related information security discipline.
• Experience investigating and responding to cybersecurity incidents across enterprise environments.
• Experience working within Security Operations Center (SOC) environments and incident response processes.
• Experience using SIEM, EDR/XDR, forensic, and threat intelligence platforms to investigate and respond to security incidents.
• Experience conducting root cause analysis, digital forensic investigations, malware analysis, or threat hunting activities.
• Familiarity with security monitoring, alert triage, incident analysis, and incident documentation processes.

Preferred Work Experience

• Advanced understanding of cyber adversary tactics, techniques, and procedures used by modern threat actors.
• Demonstrated knowledge of cybersecurity frameworks and methodologies such as NIST Cybersecurity Framework, NIST 800-61, MITRE ATT&CK, ISO 27001, or similar standards.
• Experience supporting cyber crisis management, incident response program development, or cybersecurity governance initiatives.

QBE, a global insurance leader, is the proud parent company of NAU Country Insurance Company. NAU Country writes in 48 states and has nine locations nationwide. Together, we combine the history, expertise, innovation, and a shared commitment to excellence to provide unparalleled insurance solutions to our customers and communities worldwide.

Compensation Package: The salary range for this role is provided above. This is the national range for location(s) listed. The salary offer will be decided based on the role's complexity, its location, and the candidate’s professional background, including their education and experience. Beyond the base salary, regular full-time and part-time employees will also be eligible for QBE’s annual discretionary bonus plan based on business and individual performance. We encourage all candidates to apply, even if their salary expectations fall outside of this range, as we are committed to finding the right fit for our team.

QBE Benefits: We offer a range of benefits to help provide holistic support for your work life, whatever your circumstances. As a QBE employee you will have access to:

• Hybrid Working – a mix of working from home and in the office

• 22 weeks of paid leave for family growth, with 12 weeks available to all parents on a gender-equal basis
• Competitive 401(k) program with company match up to 8%
• Well-being program including holistic wellbeing coaching, gym membership, confidential counselling, financial and legal advice
• Tuition Reimbursement for professional certifications, and continuing education
• Employee Network and Community – QBE actively supports six Employee Networks, and many ways to give back to your community

To learn more, click here: Benefits | QBE US.

Why QBE? What if you could have a positive impact – at work and in the world?

At QBE, we’re enabling a more resilient future – for our customers, communities, environment, and for our people. We’re building momentum to achieve something significant and know our people are at the center of our success.

Our industry offers interesting and varied careers where you can help people to protect what matters most. As part of the QBE team, you’ll get to spend every day working with people who are passionate, talented and kind. And our international scale means we’re big enough for your ambitions, yet small enough for you to make a real impact.

Join us now, so you can be part of our success – and we can be part of yours!

https://www.linkedin.com/company/qbe-north-america/

Commitment to Diversity:

QBE is committed to providing reasonable accommodation to, among others, individuals with disabilities and disabled veterans. If you need an accommodation because of a disability to search and apply for a career opportunity with QBE, please inform our Talent Acquisition team to let us know the nature of your accommodation request and your contact information.

Equal Employment Opportunity:

QBE provides equal employment opportunities to applicants and employees without regard to race; color; gender; gender identity; sexual orientation; religious practices and observances; national origin; pregnancy, childbirth, or related medical conditions; protected veteran status; or disability or any other legally protected status.

Supplementary information

Skills:

Adaptability, Business Continuity, Communication, Critical Thinking, Customer Service, Cybersecurity Risk Management, Digital Forensics, Intentional collaboration, Malware Analysis, Managing performance, Process Improvements, Reporting and Analysis, Risk Management, Security Incident Response, Stakeholder Management

How to Apply:

To submit your application, click "Apply" and follow the step by step process.

Equal Employment Opportunity:

QBE is an equal opportunity employer and is required to comply with equal employment opportunity legislation in each jurisdiction it operates.