Associate Engagement Lead, Incident Response

ROLES & RESPONSIBILITIES  

• Responds to Client, Counsel, Carrier (CCC) in accordance with Key Performance Indicators (KPIs) and urgency of requests
• Engagement Management (External): With oversight and assistance,
  • Leads the technical conversation and drives the direction and strategy of the engagement
  • Educates the Client on how to make informed decisions
  • Maintains accountability for accurate and timely password changes within 24 hours
  • Builds the strategy for success and delivers it
  • Assists clients with developing and executing their recovery plans
  • Establishes priorities for the Client’s IT and Arete’s engagement personnel
    • Is the subject matter expert on various technologies, infrastructure, and engagement-specific items
  • Tracks progress to completion
• Engagement Management (Internal): With oversight and assistance,
  • Communicates clearly and manages priorities by role ensuring each team member understands their tasks, values, and time to deliver
  • Ensures project workstreams are being delivered on-time
  • Monitors budget and team hours against allocated hours within the statement of work (SOW)
    • Ensures daily time entry is complete within Project management tool for the team
    • Ensures project workstreams are being delivered on-time
    • Ensures project budget is correct -identifies potential overages and requests amendments when workstream budgets reach 75%, if necessary
    • Ensures the engagement team is utilized to a blended 70%
    • Identifies opportunities for add-on services to continue assisting Clients with Arete resources
  • Ensures teams execute tasks successfully and validates work product quality
  • Provides routine updates to CCC regarding overall engagement and action items
    • Delivers to the Client on-time based on agreed upon service level agreement (SLA) and/or as needed
• May perform other duties as assigned by management

SKILLS AND KNOWLEDGE  

• Excellent time management and organizational skills
• Ability to read the room and adjust conversational style accordingly
• Ability to navigate difficult conversations with ease
• Ability to manage client expectations
• Ability to lead team members globally with guidance and take ownership over their wins and losses
• Ability to oversee projects with security implementations
• General background or knowledge of network enterprise systems administration
• General knowledge and understanding of operating systems and hardware architectures: Linux/Unix, Mainframe, Windows, Cloud, etc.
• General knowledge and experience with core set of standard Industry technology and platforms and familiarity with cybersecurity tools. Hands-on not required but a plus
  • Endpoint Detection and Response (EDR) solutions
  • E-mail platforms: Microsoft Office (M365), On-premises Exchange, Google Workspace
  • Anti-virus (AV) vendors
  • Identity Access Management (IAM)/Zero Trust systems
  • Disaster Recover Plans
  • Firewall and Virtual Private Network (VPN) platforms
  • Remote access tools
• Knowledge of Small-to medium-sized architecture
  • Network segmentation
  • Cloud Provider Platforms:
    • Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP)
  • On-premises technologies, Physical and Virtual
  • Servers, Firewalls, routers, storage, Security Information Event Management (SIEM), Multi-factor authentication
• General knowledge of containment, preservation, and acquisition of data within compromised IT environments
• General knowledge of email servers: on-premises, cloud hosted, and third-party hosted
  • Demonstrates deep understanding of configurations
  • Understands how email servers connect to or authenticate with Active Directory (AD)
  • Understands how to collect relevant logs from popular email services (Exchange, Exchange Online, Google Workspace, and M365)
    • Familiarity with or knowledge of how to familiarize oneself with additional platforms as required
  • Effortlessly directs IT personnel to perform collection of required log information
  • Secures email platforms and directs IT administrators on proper configuration techniques

JOB REQUIREMENTS

• Minimum of 5 years conducting digital investigations or managing full-cycle incident response investigations for a major consulting firm or global IR company
• Bachelor's degree in a computer science related discipline and 6+ years related experience or Master's or Advanced Degree and 5+ years related experience
• Industry certifications: GCFA, GCFE, GCIH, GISP, CISSP, Security+, MCS