Role Description - Lead and mentor a team of Incident Response analysts during active security incidents - Serve as the primary customer-facing lead during investigations and crisis situations - Coordinate incident triage, containment, eradication, and recovery efforts - Deliver executive-level communications, incident briefings, and post-incident reporting - Drive operational readiness, process improvement, and collaboration across security teams Qualifications - 5+ years of experience in Incident Response, or DFIR - Strong knowledge of ransomware, cloud, identity, and enterprise attack investigations - Excellent customer-facing communication and stakeholder management skills - Experience leading remote teams in high-pressure environments - Proficient with EDR, SIEM, threat intelligence, and forensic investigation tools - GIAC, GCFA, GCIH, CISSP, or similar certifications Requirements - Fluent in English - Experience in consulting or managed security services environments - Must be eligible to work in the US without sponsorship from an employer now or in the future Benefits - EOE M/F/Veterans/Disabled Company Description As the world’s leading vendor of Cyber Security, facing the most sophisticated threats and attacks, we’ve assembled a global team of the most driven, creative, and innovative people. At Check Point, our employees are redefining the security landscape by meeting our customers’ real-time needs and providing our cutting-edge technologies and services to an ever-growing customer base. Check Point Software Technologies has been honored by Time Magazine as one of the World’s Best Companies and Newsweek’s list of Americas Best Cybersecurity Companies. We've also earned a spot on the Forbes list of the World’s Best Places to Work for five consecutive years and recognized as one of the World’s Top Female-Friendly Companies. If you're passionate about making the world a safer place and want to be part of an award-winning company culture, we invite you to join us.

• Lead technical discovery calls and translate customer requirements into high-level solution designs • Speak credibly about product capabilities, integrations, and architectural trade-offs (e.g., Splunk, Sentinel, CrowdStrike Next-Gen SIEM, Tines, Torque, Snowflake) • Draw integration diagrams, validate technical feasibility, and position GuidePoint's differentiated capabilities • Support account executives in pre-sales engagements, ensuring technical alignment before formal scoping • Stay current on security operations trends, emerging platforms, and competitive positioning • Collaborate with delivery architects to ensure smooth transitions from sales to implementation • Embraces emerging technologies, including AI tools, to work smarter, solve problems, and drive better business outcomes

• Lead and support the response to all security events and incidents across Twilio’s complex global infrastructure, services and applications. • Be responsible for documentation of incidents and projects you work on and craft best practices as runbooks and standard operating procedures to share knowledge across teams. • Work cross-collaboratively to understand and help solve challenges related to a broad spectrum of threat actors and activity. • Work to improve Twilio’s security and reliability posture by driving identified betterments from security events and incidents. • Rapidly acquire new technical skills and knowledge in a fast-paced, highly disruptive industry environment. • Own the security incident lifecycle, respond to incidents and participate in on-call rotation and participate in RCAs for security incidents. • Build, cultivate, and maintain positive relationships with internal customers to identify and facilitate solutions to increase the impact of the team’s work. • Provide mentorship, support, and care for the team in a way that enables long-term career development, happiness, and success at scale.

• Lead and coordinate end-to-end incident response for high-severity security events within a 24/7 global on-call model, with this role operating during EMEA business hours • Prepare clear executive communications that keep stakeholders informed during incidents • Investigate complex security incidents across cloud environments, applying strong Digital Forensics and Incident Response (DFIR) methodologies • Partnering with Signals Engineering to design and implement detection capabilities, including SIEM use cases, alerting strategies, and telemetry pipelines • Build and enhance automation and AI-assisted workflows to improve triage, investigation speed, and response consistency • Partner with Threat Intelligence to contextualize threats and improve detection coverage • Conduct root cause analysis (RCA) and lead post-incident reviews to drive continuous improvement and risk reduction • Develop and maintain runbooks, playbooks, and operational documentation • Collaborate cross-functionally (Engineering, Infrastructure, Legal, Product, Communications, etc) during incidents and lead proactive initiatives (e.g. tabletops) • Mentor other engineers and help elevate the team’s overall incident response maturity