Cyber Security Incidence Response Lead

Staples Digital Solutions is strengthening its cyber defense capabilities, and we’re looking for a senior technical incident response professional to help protect our associates, customers, data, and enterprise technology environment. This role sits within Cyber Security and partners closely with Security Operations, Infrastructure, Cloud, Identity, Legal, Privacy, Risk, Human Resources, and other teams to respond to complex and high-impact cybersecurity events. Based in Framingham, MA, this opportunity reports to the Director of Security Operations and operates as a senior individual contributor with meaningful influence across the enterprise. As a Cyber Security Incidence Response Lead, you’ll serve as a senior technical escalation resource for significant cybersecurity incidents across Staples. You’ll lead hands-on investigation and response activities across endpoint, identity, cloud, network, email, and security telemetry to determine threat scope, business impact, root cause, and recommended response actions. You’ll also help mature the incident response program by improving playbooks, exercises, metrics, processes, threat-hunting practices, detection recommendations, and automation opportunities. Role requires the incumbent to work at our Framingham, MA facility but we are open to candidates that are willing to relocate to the area. We will also consider providing relocation assistance. What you’ll be doing: Conduct complex cybersecurity investigations from initial escalation through containment, eradication, recovery, and post-incident review. Analyze endpoint, identity, cloud, network, email, and log-based telemetry to identify attacker activity, determine incident scope, and assess potential impact. Provide senior technical guidance during significant incidents in partnership with SOC Leads and Managers. Coordinate response activities across Cyber Security, Infrastructure, Cloud, Identity, Legal, Privacy, GRC, Human Resources, external partners, and other business and technology teams. Develop and continuously improve incident response plans, investigative procedures, escalation processes, playbooks, exercises, metrics, and supporting documentation. Conduct proactive threat hunting based on threat intelligence, vulnerabilities, anomalous activity, and observed adversary techniques. Support insider risk investigations involving suspicious user behavior, misuse of access, data loss, or potentially malicious internal activity. Document investigation findings, lessons learned, recurring risks, and improvement opportunities from post-incident reviews. Partner with Detection Engineering, Threat Intelligence, and security technology teams to improve detection coverage, investigative capabilities, and automation. Participate in an on-call escalation rotation for significant cybersecurity incidents requiring senior technical expertise. What you bring to the table: Advanced technical investigation, analytical, and problem-solving skills. Sound technical judgment and the ability to make recommendations using incomplete or evolving information. Ability to support complex cybersecurity incidents calmly and effectively under pressure. Strong written and verbal communication skills, including the ability to translate technical findings into clear business risk considerations and recommended actions. Strong collaboration skills across technical and non-technical teams. Curiosity and initiative to identify improvements within the incident response discipline. Strong understanding of evolving attacker behaviors, techniques, and technologies. Discretion and sound judgment when handling sensitive investigations, including potential insider risk matters. Ability to participate in an on-call escalation rotation for significant cybersecurity incidents. What’s needed- Basic Qualifications: Bachelor’s degree in Computer Science, Information Security, a related field or equivalent work experience. 7+ years of cybersecurity experience, including incident response, digital forensics, threat hunting, detection engineering, or Security Operations. Experience conducting complex cybersecurity investigations in large enterprise environments. Experience developing or maintaining incident response plans, procedures, playbooks, exercises, metrics, or supporting processes. Experience conducting post-incident reviews, root cause analysis, or lessons-learned documentation. Experience coordinating technical response activities across multiple technology and business teams. What’s needed- Desired Qualifications: Experience within larger distributed enterprise environments, ideally retail and/or e-commerce. Advanced technical training or relevant cybersecurity certifications such as GCIH, GCFA, GCFE, GNFA, CISSP. Experience with Microsoft Defender XDR, Microsoft Sentinel, Microsoft Defender for Endpoint, or Microsoft Entra ID. Experience with SOAR platforms and automated incident response workflows. Hands-on experience investigating endpoint, identity, cloud, network, email, or log-based security telemetry. Hands-on experience using SIEM, EDR/XDR, identity security, cloud security monitoring, or security automation technologies. Experience conducting enterprise threat hunting or developing detection content. Experience supporting insider risk, user behavior, data loss, or other user-focused security investigations. Experience investigating identity-based or cloud-based attacks. Experience responding to ransomware, credential compromise, business email compromise, insider threats, data theft, or supply-chain incidents. Knowledge of cybersecurity incident response requirements, including PCI DSS and applicable privacy requirements. What’s needed- Desired Qualifications: Advanced technical training or relevant cybersecurity certifications such as GCIH, GCFA, GCFE, GNFA, CISSP. Experience with Microsoft Defender XDR, Microsoft Sentinel, Microsoft Defender for Endpoint, or Microsoft Entra ID. Experience with SOAR platforms and automated incident response workflows. Experience conducting enterprise threat hunting or developing detection content. Experience supporting insider risk, user behavior, data loss, or other user-focused security investigations. Experience investigating identity-based or cloud-based attacks. Experience responding to ransomware, credential compromise, business email compromise, insider threats, data theft, or supply-chain incidents. Knowledge of cybersecurity incident response requirements, including PCI DSS and applicable privacy requirements. Experience within large retail, e-commerce, or distributed enterprise environments. We Offer: Inclusive culture with associate-led Business Resource Groups 22 days of PTO and Holiday Schedule (7 observed paid holidays + 1 floating holiday) Online and Retail Discounts, Company Match 401(k), Physical and Mental Health Wellness programs, and more! The salary range represents the expected compensation for this role at the time of posting. The specific base pay may be influenced by a variety of factors to include the candidate's experience, skill set, education, geography, business considerations, and internal equity. In addition to base pay, this role may be eligible for bonuses, or other forms of variable compensation.