Security Specialist – Incident Response

About the role

Executive Operations is looking for a Security Specialist to enhance incident management, on‑call operations, security tooling, and SOC workflows across internal and client environments. The role focuses on configuring incident response platforms, reducing alert fatigue, and ensuring critical security systems are continuously improved.

Key responsibilities

• Configure, administer, and optimize incident management platforms such as PagerDuty, Opsgenie, FireHydrant, and incident.io.
• Design escalation policies, on‑call schedules, routing rules, service dependencies, and severity classifications.
• Develop incident workflows, response playbooks, runbooks, and post‑incident review processes.
• Integrate incident platforms with Microsoft Defender, CrowdStrike, Cloudflare, Microsoft Sentinel, Slack, Teams, and other security tools.
• Create automation and alert‑routing logic to improve response efficiency.
• Monitor platform health, user access, and generate reporting on incident trends and performance.
• Manage security platforms across endpoint, identity, email, DNS, and cloud environments, including Cloudflare Gateway, WARP, and DNS Firewall.
• Develop KQL detection logic, threat‑hunting queries, and alerting rules within Microsoft Sentinel.
• Serve as Tier 2/3 escalation point for SOC analysts during active incidents and produce incident reports and remediation recommendations.
• Create and maintain SOPs, technical documentation, configuration guides, and security runbooks.

Required profile

• Hands‑on experience with incident response platforms (PagerDuty, Opsgenie, FireHydrant, incident.io).
• Strong background in security operations, threat detection, and SOC workflows.
• Experience integrating security tools such as Microsoft Defender, CrowdStrike, Cloudflare, Microsoft Sentinel, Slack, and Teams.
• Proficiency in developing KQL queries and threat‑hunting logic.
• Ability to produce detailed incident documentation and post‑mortem analysis.

Required skills

• PagerDuty
• Opsgenie
• FireHydrant
• incident.io
• Microsoft Defender
• CrowdStrike
• Cloudflare (Gateway, WARP, DNS Firewall)
• Microsoft Sentinel
• Slack
• Microsoft Teams
• KQL (Kusto Query Language)
• Endpoint Detection & Response (EDR)
• Threat hunting
• Incident response playbooks
• SOC escalation procedures