Senior Incident Responder (Cybersecurity)

Location: Remote, United States

Company

BlackCloak provides digital protection and incident response services for executives, board members, and other high-profile individuals.

What you will do

• Lead the full incident response lifecycle, from client intake and triage through containment, eradication, recovery, and post-incident reporting.
• Investigate and remediate compromised email ecosystems, SIM swaps, financial account takeovers, credential harvesting, endpoint malware, and mobile threats.
• Perform forensic analysis of Windows, macOS, iOS, Android, and Linux devices, as well as vulnerability scans of client infrastructure.
• Analyze account activity and financial transactions and support fraud investigations, disputes, chargebacks, account freezes, and identity-theft remediation.
• Map incidents against cyber and personal attack kill chains to identify exposure and actions that can break the attack.
• Provide calm, direct guidance to clients, families, assistants, family offices, and corporate security teams; serve as the senior escalation point and mentor other responders.

Requirements

• 5–8+ years of experience in incident response, digital forensics, or advanced cybersecurity analysis.
• Demonstrated experience handling executive or personal account takeovers, mobile threats, endpoint malware, and the complete incident lifecycle.
• Experience investigating financial fraud and coordinating with banks or credit card companies on disputes, chargebacks, transaction analysis, or account-takeover cases.
• Deep forensic and vulnerability-management expertise across Windows, macOS, iOS, Android, and Linux.
• Knowledge of identity-theft remediation and attack kill-chain models, with the ability to apply them to individuals and families.
• Exceptional communication skills, empathy under pressure, independent judgment, and an IT, computer science, or computer engineering degree or equivalent experience.

Nice to have

• Advanced certifications such as GCIH, GCFA, CISSP, OSCP, or similar.
• Fraud or financial-crime credentials such as CFE, CFCS, or CAMS.

Culture & Benefits

• Remote full-time role serving high-profile clients directly.
• Occasional nights and weekends are required through an on-call and escalation rotation.
• Opportunity to improve internal incident-response playbooks and mentor security and client-success colleagues.