Jobs and Careers
HI
Senior Security Specialist – Incident Management
HighLevelUnited StatesRemotefull_timeVerifiedPosted 3 Oct 2025
About the role
About HighLevelHighLevel is a cloud-based, all-in-one white-label marketing and sales platform that empowers marketing agencies, entrepreneurs, and businesses to elevate their digital presence and drive growth. We are proud to support a global and growing community of over 2 million businesses, from marketing agencies to entrepreneurs to small businesses and beyond. Our platform empowers users across industries to streamline operations, drive growth, and crush their goals.
HighLevel processes over 15 billion API hits and handles more than 2.5 billion message events every day. Our platform manages 470 terabytes of data distributed across five databases, operates with a network of over 250 micro-services, and supports over 1 million domain names.
Our PeopleWith over 1,500 team members across 15+ countries, we operate in a global, remote-first environment. We are building more than software; we are building a global community rooted in creativity, collaboration, and impact. We take pride in cultivating a culture where innovation thrives, ideas are celebrated, and people come first, no matter where they call home.
Our ImpactEvery month, our platform powers over 1.5 billion messages, helps generate over 200 million leads, and facilitates over 20 million conversations for the more than 2 million businesses we serve. Behind those numbers are real people growing their companies, connecting with customers, and making their mark - and we get to help make that happen.
Learn more about us on our YouTube Channel or Blog Posts
About The RoleWe are seeking an experienced and proactive Senior Security Specialist – Incident Management to join our security operations team. This role will be responsible for monitoring, detecting, analyzing, and responding to security incidents. The ideal candidate will have deep expertise in incident management, strong analytical skills, and hands-on experience with enterprise-grade detection and response platforms. The analyst will lead investigations, coordinate with cross-functional teams, and provide actionable insights to reduce risk and strengthen the organization’s overall security posture.
Key Responsibilities- Monitor and analyze alerts from SIEM, EDR, CSPM, and cloud-native security platforms.- Perform initial triage, validation, and escalation of security alerts and suspicious activity.- Develop and tune detection rules, dashboards, and queries for improved monitoring.- Lead incident containment, eradication, and recovery activities.- Conduct in-depth investigations of endpoint, cloud, and network-based threats.- Maintain and improve incident response playbooks aligned with NIST 800-61 and MITRE ATT&CK.- Perform proactive threat hunting across SIEM, EDR, and cloud environments.- Conduct forensic analysis, root cause investigations, and evidence collection.- Apply threat intelligence to enhance detection and reduce dwell time.- Partner with IT, Cloud, Security, Legal, and Compliance teams for coordinated incident resolution.- Work with LEA in the US to receive threat intelligence and share updates whenever required.- Investigate container security incidents (e.g., Kubernetes, Docker) including misconfigurations, runtime threats, and unauthorized access.- Analyze application-layer attacks such as SQL injection, XSS, RCE, and API abuse.- Collaborate with DevOps/AppSec teams to assess vulnerabilities identified during incidents and provide remediation guidance.- Conduct log analysis and forensic review of application and container environments to identify compromise indicators.- Provide clear, actionable updates to both technical and executive audiences.- Prepare detailed incident reports and present monthly/quarterly security metrics.- Recommend improvements in logging, monitoring, and automation (SOAR).- Track and report KPIs such as MTTR, incident volume, and trend analysis.- Contribute to tabletop exercises, red/blue team simulations, and readiness drills.
Required Qualifications- Bachelor’s degree (or equivalent experience) in Information Security, Computer Science, or related field.- 6+ years of hands-on experience in incident management, SOC operations, or cybersecurity analysis.- Practical expertise with: - SIEM (e.g., Google SecOps / Chronicle, Splunk, Microsoft etc.) - EDR (e.g., SentinelOne, CrowdStrike, Microsoft etc.)
HighLevel processes over 15 billion API hits and handles more than 2.5 billion message events every day. Our platform manages 470 terabytes of data distributed across five databases, operates with a network of over 250 micro-services, and supports over 1 million domain names.
Our PeopleWith over 1,500 team members across 15+ countries, we operate in a global, remote-first environment. We are building more than software; we are building a global community rooted in creativity, collaboration, and impact. We take pride in cultivating a culture where innovation thrives, ideas are celebrated, and people come first, no matter where they call home.
Our ImpactEvery month, our platform powers over 1.5 billion messages, helps generate over 200 million leads, and facilitates over 20 million conversations for the more than 2 million businesses we serve. Behind those numbers are real people growing their companies, connecting with customers, and making their mark - and we get to help make that happen.
Learn more about us on our YouTube Channel or Blog Posts
About The RoleWe are seeking an experienced and proactive Senior Security Specialist – Incident Management to join our security operations team. This role will be responsible for monitoring, detecting, analyzing, and responding to security incidents. The ideal candidate will have deep expertise in incident management, strong analytical skills, and hands-on experience with enterprise-grade detection and response platforms. The analyst will lead investigations, coordinate with cross-functional teams, and provide actionable insights to reduce risk and strengthen the organization’s overall security posture.
Key Responsibilities- Monitor and analyze alerts from SIEM, EDR, CSPM, and cloud-native security platforms.- Perform initial triage, validation, and escalation of security alerts and suspicious activity.- Develop and tune detection rules, dashboards, and queries for improved monitoring.- Lead incident containment, eradication, and recovery activities.- Conduct in-depth investigations of endpoint, cloud, and network-based threats.- Maintain and improve incident response playbooks aligned with NIST 800-61 and MITRE ATT&CK.- Perform proactive threat hunting across SIEM, EDR, and cloud environments.- Conduct forensic analysis, root cause investigations, and evidence collection.- Apply threat intelligence to enhance detection and reduce dwell time.- Partner with IT, Cloud, Security, Legal, and Compliance teams for coordinated incident resolution.- Work with LEA in the US to receive threat intelligence and share updates whenever required.- Investigate container security incidents (e.g., Kubernetes, Docker) including misconfigurations, runtime threats, and unauthorized access.- Analyze application-layer attacks such as SQL injection, XSS, RCE, and API abuse.- Collaborate with DevOps/AppSec teams to assess vulnerabilities identified during incidents and provide remediation guidance.- Conduct log analysis and forensic review of application and container environments to identify compromise indicators.- Provide clear, actionable updates to both technical and executive audiences.- Prepare detailed incident reports and present monthly/quarterly security metrics.- Recommend improvements in logging, monitoring, and automation (SOAR).- Track and report KPIs such as MTTR, incident volume, and trend analysis.- Contribute to tabletop exercises, red/blue team simulations, and readiness drills.
Required Qualifications- Bachelor’s degree (or equivalent experience) in Information Security, Computer Science, or related field.- 6+ years of hands-on experience in incident management, SOC operations, or cybersecurity analysis.- Practical expertise with: - SIEM (e.g., Google SecOps / Chronicle, Splunk, Microsoft etc.) - EDR (e.g., SentinelOne, CrowdStrike, Microsoft etc.)
Apply for this role
Generate a tailored application kit with a matched cover letter, interview prep, and CV highlights — in under 60 seconds.
Apply Now →Generate Application KitFree account required — sign up in 30s