Incident Response Analyst

Handles triage, scoping, containment, and eradication, collecting and preserving evidence across endpoint, identity, and cloud. This person is calm and methodical, fluent in timelines and basic forensics, and coordinates with legal and communications when needed. They keep the IR plan current and run tabletop exercises to improve readiness.