Incident response analyst

An incident response analyst investigates and contains cybersecurity incidents when defenses are breached. They detect and analyze attacks, determine scope and impact, contain the threat to stop it spreading, gather and preserve forensic evidence, lead the technical recovery, and document lessons to prevent recurrence — the firefighters of cybersecurity.

The role is high-pressure and time-critical, requiring deep technical security knowledge, calm under stress, and methodical investigation while an attack is unfolding. Analysts work at security firms, consultancies, and large organizations.

The job suits sharp, composed people who thrive in crisis, can piece together what happened from fragments of evidence, and want to be the ones called when something goes badly wrong.