Incident Response Team Lead

Incident Response Team Lead Location: Arlington Heights, IL (Onsite) | Contract Overview Our client is seeking an Incident Response Team Lead to direct day-to-day incident response operations and provide hands-on leadership within a 24x7 security environment. This individual will lead analysts through the full incident lifecycle, serve as the escalation point for complex or high-severity events, coordinate containment and recovery, and strengthen team performance through coaching, quality review, metrics, playbook development, and continuous improvement. Responsibilities

Lead day-to-day incident response operations, including workload prioritization, analyst assignments, shift coordination, and escalation management. Serve as leader for complex and high-severity events, directing investigation, containment, eradication, recovery, and post-incident activities. Validate alert triage and investigative findings, ensuring incidents are accurately scoped, prioritized, documented, and escalated. Coordinate response activities across clients, SOC teams, threat intelligence, engineering, legal, compliance, and other business stakeholders. Provide hands-on technical leadership in malware analysis, network traffic analysis, endpoint forensics, threat hunting, and root-cause analysis. Use CrowdStrike, Splunk, and related security platforms to guide investigations, improve detection coverage, and accelerate response. Deliver concise incident updates, executive briefings, final reports, and risk-based recommendations to clients and management. Own operational metrics and reporting, including incident volume, severity, response times, case aging, trends, and service-level performance. Coach and mentor analysts, review case quality, provide actionable feedback, and support training and readiness exercises. Maintain and improve incident response plans, playbooks, escalation procedures, shift handoffs, and investigation standards. Lead post-incident reviews and translate lessons learned into measurable improvements across people, process, and technology.

Required Qualifications

Bachelor's degree in Computer Science, Cybersecurity, or a related field, or equivalent professional experience. Seven or more years of SOC or incident response experience, including 3 years leading analysts, shifts, investigations, or major incidents. Demonstrated ability to lead high-severity incidents, make timely decisions under pressure, and coordinate technical and business stakeholders. Advanced knowledge of incident response, threat detection, malware analysis, endpoint forensics, network analysis, and threat hunting. Strong hands-on experience with EDR and SIEM technologies, including CrowdStrike and Splunk. Experience developing incident response playbooks, escalation procedures, quality standards, metrics, and after-action reviews. Working knowledge of recognized security frameworks and standards, including NIST and ISO 27001. Proven ability to coach analysts, provide constructive feedback, delegate effectively, and build team readiness. Executive-level written and verbal communication skills, including the ability to explain technical risk and response decisions to clients and senior leaders. Ability to collaborate in English with global teams and support assigned shifts within a 24x7 operation. Highly organized, decisive, and adaptable, with the ability to manage competing priorities and maintain quality in a fast-paced environment.

Preferred Qualifications

Relevant certifications such as GCIH, GCIA, GCFA, or CISSP.

Pay rate: $45-50/hr. This is a 12 months contract position, Onsite in Arlington Heights, IL.