CYPFER

• Engage on behalf of CYPFER in incident response tasks, interacting with various insurance partners, legal counsel, incident response units, client executives, and technical teams. • Utilize standard tools and methodologies to collect forensic artifacts and images from affected systems. • Assist with Windows forensics and triage to assess compromise and investigations. • Familiarity with malware analysis tools and methodologies. • Apply mitigation strategies and concepts to remediate identified threats. • Analyze triage collections/artifacts for indicators of compromise (IOCs) and potentially malicious activity. • Review logs from host systems and appliances to identify suspicious activities. • Collect forensic disk and memory images from physical and virtual endpoints and servers. • Understanding of an incident lifecycle and cyber-kill-chain. • Correlate events and build timelines of events. • Maintain current knowledge on emerging threats and vulnerabilities. • Analyze files for IOCs using various techniques.

• Coordinate and manage the scoping, quoting, and contracting process for client and partner engagements. • Participate in scoping calls and take detailed technical notes to support contract development. • Act as the primary liaison between clients, partners, and technical teams to ensure efficient engagement execution. • Translate client needs and incident details into actionable service scopes aligned with cybersecurity best practices. • Support sales and effort estimation during pre-engagement phases. • Contribute to the creation of Statements of Work (SoWs) and maintain strong relationships with decision-makers for a smooth contract signoff. • Ensure consistent delivery of high-quality service & support on a client and partner engagement. • Ensure consistent, timely resolution (scope and contract) of issues. • Ensure consistent professional conduct. • Assist in reporting and documentation for client engagements and commercial activities. • Provide after-hours support on a rotational basis, ensuring responsiveness during critical incidents.

• Serve as the initial point of contact for inbound, time-sensitive cyber incidents, monitoring designated intake channels and responding within required timeframes. • Coordinate and facilitate rapid scoping calls with clients and internal stakeholders to support swift case activation. • Act as a client-facing communications lead during early-stage incidents, maintaining clear, calm, and professional engagement under pressure. • Collect, organize, and document pre-scoping and intake information required to support operational readiness and Statement of Work (SOW) drafting. • Create and manage secure internal communication channels (e.g., Slack or Telegram) for active incidents, ensuring accurate, real-time updates are maintained. • Track incident status, action items, and dependencies, proactively following up to keep cases moving forward. • Support post-scoping operational steps, including coordination of secure data exchange processes and internal handoffs once approvals are in place. • Maintain detailed and organized case notes, timelines, and communication records throughout the lifecycle of an incident. • Escalate risks, blockers, or urgent issues promptly to appropriate internal stakeholders. • Operate effectively in high-pressure, fast-moving situations, adapting quickly as new information becomes available.

• Coordination and management of scoping, proposal, and contracting processes for client and partner engagements • Active participation in scoping discussions and detailed technical note-taking to support contract development • Primary point of contact between clients, partners, and the technical team for engagement execution • Support for sales and effort estimation during pre-engagement phases • Ensuring consistent delivery of high-quality service and support for client and partner engagements • Post-incident follow-up for critical incidents

• Lead technical recovery efforts during major cyber incidents • Direct teams rebuilding compromised infrastructure and identity platforms • Serve as a senior technical resource for complex recovery challenges • Guide containment, eradication, and recovery operations • Help design and execute secure rebuild strategies for enterprise environments • Communicate clearly with executives, legal teams, and technical stakeholders • Mentor and support consultants across multiple engagements • Contribute to the development of recovery playbooks and frameworks

• Manage a portfolio of complex initiatives that span one or multiple lines of business • Collaborate with other teams to ensure agility and eliminate unnecessary delays • Full engagement life cycle ownership: successful engagement delivery • Manage all aspects of multiple related engagements to ensure the overall program is aligned to and directly supports the achievement of strategic objectives • Report on success criteria results, metrics, test and deployment management activities

• Serve as the initial point of contact for inbound, time-sensitive cyber incidents, monitoring designated intake channels and responding within required timeframes • Coordinate and facilitate rapid scoping calls with clients and internal stakeholders to support swift case activation • Act as a primary client-facing communications contact during early-stage incidents, maintaining clear, calm, and professional engagement under pressure • Collect, organize, and document pre-scoping and intake information required to support operational readiness and Statement of Work (SOW) drafting • Create and manage secure internal communication channels (e.g., Slack or Telegram) for active incidents, ensuring accurate, real-time updates are maintained • Track incident status, action items, and dependencies, proactively following up to keep cases moving forward • Support post-scoping operational steps, including coordination of secure data exchange processes and internal handoffs once approvals are in place • Maintain detailed and organized case notes, timelines, and communication records throughout the lifecycle of an incident • Escalate risks, blockers, or urgent issues promptly to appropriate internal stakeholders • Operate effectively in high-pressure, fast-moving situations, adapting quickly as new information becomes available

• Serve as the initial point of contact for inbound, time-sensitive cyber incidents, monitoring designated intake channels and responding within required timeframes. • Coordinate and facilitate rapid scoping calls with clients and internal stakeholders to support swift case activation. • Act as a client-facing communications lead during early-stage incidents, maintaining clear, calm, and professional engagement under pressure. • Collect, organize, and document pre-scoping and intake information required to support operational readiness and Statement of Work (SOW) drafting. • Create and manage secure internal communication channels (e.g., Slack or Telegram) for active incidents, ensuring accurate, real-time updates are maintained. • Track incident status, action items, and dependencies, proactively following up to keep cases moving forward. • Support post-scoping operational steps, including coordination of secure data exchange processes and internal handoffs once approvals are in place. • Maintain detailed and organized case notes, timelines, and communication records throughout the lifecycle of an incident. • Escalate risks, blockers, or urgent issues promptly to appropriate internal stakeholders. • Operate effectively in high-pressure, fast-moving situations, adapting quickly as new information becomes available.