Lead Incident Response Analyst

DeepSeas owns cyber risk for its clients: autonomously, continuously, and with proof. The company brings security technology, threat intelligence, and expert practitioners together to deliver coordinated cyber defense, helping organizations strengthen protection while reducing the work required of their internal teams.

Combining agentic AI with human judgment, DeepSeas automates threat analysis and response within client-defined boundaries, continuously improves defenses through threat hunting and detection engineering, and provides visibility into investigations, actions taken, and service performance. Its technology-agnostic approach works with the security investments clients already have.

DeepSeas connects 24/7 managed detection and response with offensive security, vulnerability management, governance, risk and compliance, CISO advisory, and incident response. With 30 years of experience in cyber defense.

DeepSeas is trusted by nearly 1,000 clients around the world, including Fortune 100 enterprises and mid-market organizations. Its team of more than 250 cybersecurity professionals serves clients across 30+ countries.

Frost & Sullivan recognized DeepSeas as an Innovation Index standout in its 2025 Frost Radar™ for Managed Detection and Response and awarded the company its 2024 Competitive Strategy Leadership Award in the global MDR market.

Defend Like You Know What’s Coming™

Learn more at deepseas.com.

The Lead IR Analyst is a pivotal leader within DeepSeas’ cybersecurity operations. This role not only ensures the rapid detection, analysis, and resolution of security incidents, but also drives cross-functional coordination and continuous improvement. Responsibilities include triaging alerts, conducting forensic investigations, and implementing corrective actions to mitigate threats. The Lead IR Analyst elevates the function by leading strategic initiatives, mentoring junior team members, and shaping the development of incident response tools and playbooks, ensuring the organization remains resilient and proactive in the face of evolving cyber threats.

The following are the major results needed for success in the role. Additional responsibilities, tasks, and duties will be assigned and required as needed.

• Lead the IR Analyst team.
• Serve as the point of contact and escalation point for all IR incidents.
• Perform deep-dive and forensic analysis of logs, systems, and network traffic.
• Document and lead incidents from detection through resolution.
• Work with partners to ensure compliance and that proper processes are in place.
• Develop and maintain incident response playbooks and procedures.
• Lead investigations of complex security incidents and coordinate response efforts.
• Provide mentorship and guidance to junior analysts.
• Prepare detailed incident reports and executive summaries.
• Provide accurate, punctual reports as required or assigned.
• Initiate communication and information sharing with internal team members, team leaders, and inter-company departments.
• Open to candidates in the US and Costa Rica.
• Travel up to 5% of the time as required.

Below are the minimum skills, formalized training, practical experience, and/or education required to perform the general functions and duties of the role.

Minimum Qualifications

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field.
• 5+ years of experience in incident response, security operations, or threat detection.
• Experience with forensic analysis, malware investigation, and threat intelligence gathering.
• Strong knowledge of SIEM tools, EDR, and forensic techniques.
• Familiarity with malware analysis, log analysis, and network traffic inspection.
• Excellent communication and leadership skills.
• Ability to work under pressure and manage multiple incidents simultaneously.
• Fluent in English.
• Must be able to understand job duties and responsibilities, have the necessary skills and knowledge, and be willing and able to continue learning and growing within the field.
• If a US candidate, must be a U.S. citizen residing in the United States.

Preferred Qualifications

• Industry certifications such as GIAC Certified Incident Handler (GCIH), Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), or CompTIA Security+.
• Proficiency in scripting languages (e.g., Python, PowerShell) for automation.

Information security is everyone’s responsibility:

• Understanding and following DeepSeas’ information security policies and procedures.
• Remaining vigilant and reporting any suspicious activity or possible weaknesses in DeepSeas’ information security.
• Actively participating in DeepSeas’ efforts to maintain and improve information security.

• Fully remote company with team members across the U.S.
• Hands-on, mission-driven work protecting clients against real-world threats every day.
• A collaborative team that shares knowledge and invests in your growth.
• Opportunities to lead, mentor, and shape how our SOC responds to incidents.
• Comprehensive benefits package including healthcare, dental, vision, PTO, Sick Leave, Personal Choice Holidays, Life/Accident Insurance, 401(k) match, and Company Bonus.