Associate Director, Cyber Defense Incident Responder

About the role

EY's Information Security unit (InfoSec) protects its own data and that of its clients, and offers three business units: Client Technology, Enterprise Workplace Technology and Information Security. This Associate Director role sits within Cyber & Investigative Services (CIS) and coordinates incident response to global cybersecurity events or incidents arising from suspected threats. It is a senior position requiring strong incident management, communication and decision-making skills, and on-call availability.

Key responsibilities

• Coordinate complex response efforts to global cybersecurity incidents caused by external threats, which may involve non-traditional working hours
• Serve as liaison and relationship manager with businesses, other Information Security teams, business partners, management, vendors and external parties
• Maintain relationships with General Counsel, Data Privacy/Protection and Risk Management contacts
• Integrate with other corporate incident management programs and oversee CIS projects as directed by leadership
• Counsel and manage junior members of the Cyber Incident Response team
• Lead process and documentation development, and drive continuous improvement of the global incident response plan
• Develop and deliver metrics to leadership on operational improvement, report team performance and deficiencies, and draft communications and timely reports to leadership
• Own or oversee processes and documentation, and be willing to work on-call off hours in rotation with other team members

Required profile

• Bachelor's or Master's degree in Computer Science, Information Systems, Engineering or a related field, or equivalent experience
• 10+ years combined experience as an Information Security Professional or Information System Administration/Engineering role
• 5+ years combined experience in SOC Analyst/Manager, Threat Intelligence, Detection Engineering, Attack & Penetration Testing, eDiscovery or similar cyber defense functions
• 3+ years combined experience as a DFIR Analyst/Manager or Cybersecurity Incident Coordinator
• Exceptional comprehension of the incident response lifecycle and ability to coordinate high-profile, complex, global incidents
• Ability to manage through ambiguity, make sound judgments under pressure, and balance work and personal priorities

Required skills

• Digital forensics and incident response, including log correlation, malware analysis and electronic investigation
• Knowledge of network topography and protocols, and familiarity with legal aspects of electronic discovery
• Experience with SIEM tools (e.g. Sentinel), cloud consoles (e.g. Azure) and digital forensics tools
• Windows and Unix/Linux operating systems
• Operationalizing automation to improve process efficiency
• Professional certifications such as GCFE, GCFA, GCIH, CISA, CISM, CISSP or CCIM are ideal