Senior Incident Response (IR) Analyst

Job description

As the number of cyberattacks and digital threats continue to grow, our world needs more passionate and innovative individuals who seek to be trailblazers in and shapers of the rapidly evolving cybersecurity landscape. At Trend Micro, we offer tremendous opportunities that will challenge and equip you to become engineered to do good in whatever path you take. By choosing to be an agent of change, you will be part of an impactful mission that aims to make the world safe for exchanging digital information. This role requires strong technical expertise, sound judgment under pressure, and the ability to communicate clearly with both technical teams and business stakeholders during high-stakes incidents. We are especially interested in candidates with hands-on experience applying AI tools to security operations and incident response, as we continue to expand AI-driven detection, triage, and analysis capabilities across the team. Lead investigations into security incidents, including malware infections, data breaches, and advanced persistent threats (APTs) Perform forensic analysis on compromised systems, network traffic, and log data (e.g., WAF, firewall, endpoint, cloud, and application logs) Evaluate, pilot, and integrate AI-based tools (e.g., AI-powered SIEM/XDR triage, anomaly detection, LLM-assisted log analysis and report generation) into the incident response lifecycle Provide timely, accurate incident reports and executive summaries to stakeholders and customers Identify indicators of compromise (IOCs) and threat actor tactics, techniques, and procedures (TTPs), including AI-enabled attack methods. Mentor and guide junior analysts on investigation methodology, best practices, and use of AI-assisted tooling Create and implement improvements to detection, monitoring, and response capabilities, including AI/automation-driven enhancements Maintain awareness of the evolving threat landscape, including emerging vulnerabilities, attack techniques, and AI-related threats (e.g., AI-generated phishing, adversarial ML) Support post-incident reviews and root cause analysis to strengthen organizational security posture Required Qualifications 5+ years of experience in incident response and digital forensics Demonstrated experience with AI-related projects or activities in a security context (e.g., deploying or tuning AI-based detection/triage tools, using generative AI/LLMs to accelerate investigations or reporting, building automation that leverages machine learning models) Prior experience working directly with clients/customers during live incident engagements Strong understanding of network protocols, operating systems (Windows/Linux), and cloud environments (AWS, Azure, GCP) Proven experience conducting cloud forensics investigations across major cloud service providers (AWS, Azure, GCP), including: Acquiring and analyzing cloud-native artifacts (VM snapshots/disk images, memory captures, container images, serverless function logs) Analyzing cloud control plane and audit logs (e.g., Azure Activity Log, AWS CloudTrail, GCP Audit Logs) to reconstruct attacker activity and timelines Understanding shared responsibility models and their impact on evidence availability and collection methods Investigating incidents involving cloud storage (e.g., S3 buckets, Azure Blob Storage), managed databases, and Kubernetes/container orchestration environments Working with volatile and ephemeral cloud resources where traditional forensic imaging techniques may not apply Hands-on experience with SIEM platforms, EDR/XDR tools, and log analysis (e.g., Splunk, CrowdStrike, Microsoft Sentinel), including AI-enabled features of these platforms Relevant certifications such as GCIH, GCFA, GNFA, CISSP, CEH, OSCP, or cloud-specific credentials. Familiarity with WAF, load balancer, and application gateway logs (e.g., Azure Application Gateway, Cloudflare, AWS WAF) Solid understanding of the MITRE ATT&CK framework and threat intelligence concepts Experience conducting forensic investigations and chain-of-custody procedures, including in distributed and multi-cloud environments Excellent written and verbal communication skills, with the ability to translate technical findings for non-technical audiences Ability to work under pressure and manage multiple concurrent investigations Bachelor's degree in Computer Science, Information Security, or related field (or equivalent experience) Preferred Qualifications Experience with scripting/automation (Python, PowerShell) for investigation tasks, including integrating AI libraries or APIs into workflows Practical exposure to concepts such as model training, prompt engineering, or AI governance/risk as applied to cybersecurity Experience with cloud-native security tools and container security Familiarity with cloud-native forensic and incident response tooling (e.g., AWS Detective, Azure Sentinel, Google Chronicle, Magnet AXIOM Cloud) Be Passionate. Be Innovative. Be a Trender. Be #EngineeredToDoGood.