The Cyber Security Incident Response II is responsible for detecting, analyzing, investigating, and responding to cybersecurity threats and incidents across the enterprise. This role performs advanced threat detection, incident triage, forensic analysis, containment, and recovery activities coordinated across internal and external stakeholders.

The ideal candidate possesses a strong foundation in cyber security incident response, digital forensics, detection capabilities, and stakeholder engagement. This position requires the ability to independently manage complex cybersecurity incidents, collaborate effectively with business and technical teams, influence decision-making through risk-based recommendations, and perform successfully in time-sensitive and high-pressure environments.

This role partners with third-party service providers, vendors, infrastructure teams, and security engineering and architecture teams to strengthen the organization's security posture and improve incident response capabilities. The candidate will maintain a strong understanding of AmTrust's mission, vision, and values while upholding the highest standards of professionalism and service.

• Investigate security alerts, suspicious activity, and cybersecurity incidents to determine scope, impact, root cause, and remediation actions.
• Lead the analysis and response efforts for medium- to high-complexity security incidents, ensuring timely containment, eradication, recovery, and documentation.
• Perform digital forensics, log analysis, artifact collection and preservation, and host and network investigations using enterprise security monitoring and endpoint detection tools.
• Analyze indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs), and threat intelligence to support investigations.
• Utilize SIEM, EDR, threat intelligence, cloud security, and case management platforms to investigate and respond to security incidents.
• Develop and maintain detection logic, correlation rules, analytics, and response playbooks to improve detection and response capabilities.
• Document investigation findings, incident timelines, root cause analysis, and lessons learned in accordance with established procedures.
• Collaborate with IT, Security, Legal, Risk, HR, and Compliance teams as required during incident investigations.
• Participate in tabletop exercises, incident response simulations, and post-incident reviews to validate and improve response readiness.
• Recommend improvements to security controls, detection content, monitoring coverage, and response processes based on investigative findings.
• Participate in on-call and after-hours incident response support as required.

• Bachelor's degree in Cyber Security, Information Technology, Computer Science, Information Systems, or a related field. Equivalent practical experience may be considered in lieu of a degree.
• 3-5+ years of experience in cyber security incident response, digital forensics, security operations, threat hunting, or related cyber security disciplines.
• Experience investigating and responding to security incidents in enterprise environments.
• Strong understanding of threat actor tactics, techniques, and procedures, cyber attack methodologies, and incident response frameworks.
• Experience working with security monitoring technologies, including SIEM, EDR/XDR, email security, identity security, and cloud security platforms.
• Ability to manage multiple investigations while maintaining attention to detail and documentation quality.
• Strong analytical, problem solving, written, and verbal communication skills.
• Ability to effectively communicate technical findings and risk-based recommendations to both technical and non-technical audiences.
• Proven ability to work independently, manage competing priorities, and perform effectively in fast-paced, high-pressure environments.

Preferred:

• Industry certifications such as Security+, CySA+, SecurityX (formerly CASP+) GCIH, GCFA, GCIA, GNFA, CISSP, or other relevant cybersecurity certifications.
• Experience investigating incidents across hybrid environments.
• Experience conducting malware analysis, memory analysis, and digital forensic investigations.
• Knowledge of scripting, automation, and query languages such as PowerShell, Python, KQL, SPL, or similar languages.
• Experience operating in highly regulated industries and familiarity with applicable cybersecurity regulatory requirements.

AmTrust Financial Services offers a competitive compensation package and excellent career advancement opportunities. Our benefits include: Medical & Dental Plans, Life Insurance, including eligible spouses & children, Health Care Flexible Spending, Dependent Care, 401k Savings Plans, Paid Time Off.

AmTrust strives to create a diverse and inclusive culture where thoughts and ideas of all employees are appreciated and respected. This concept encompasses but is not limited to human differences with regard to race, ethnicity, gender, sexual orientation, culture, religion or disabilities.

AmTrust values excellence and recognizes that by embracing the diverse backgrounds, skills, and perspectives of its workforce, it will sustain a competitive advantage and remain an employer of choice. Diversity is a business imperative, enabling us to attract, retain and develop the best talent available. We see diversity as more than just policies and practices. It is an integral part of who we are as a company, how we operate and how we see our future.