Incident Response Engagement Manager, Arctic Wolf

• Critical thinking and troubleshooting skills
• Attention to detail
• Organizational skills
• Project management skills
• Ability to multi-task on more than one case at a time
• Verbal and written communication skills
• Time-management skills
• Documentation skills
• Crisis communication skills (i.e. - deescalating)
• Ability to anticipate Client needs and questions before they come up
• Ability to lead and manage a diverse team of technical experts on multiple cases at a time
• Stress management skills
• 6 months to 2 years of project and/or case management, technical customer service or similar type of experience
• General knowledge of the Cyber Incident Response Lifecycle
• Must be able to be on calls with Clients for a long period of time, when needed
• Mostly remote work; must have quiet environment free of distractions
• Work is primarily sedentary in nature and can be executed sitting or standing positions in an office environment
• Requires ability to utilize technology related to using a keyboard, verbal communication, and work with device screens which require visual acuity
• If located in a company office, it often requires mobility to physically navigate the space
• May include moving or lifting 25 pounds or less (e.g., office chair, reams of paper)
• In the event of business travel, mobility sufficient to utilize public and private transport and navigate to essential locations
• Travel Requirements: Minimal – 5-10% for occasional team meetups, conferences or speaking events
• Conducts duties and responsibilities in accordance with AWN’s Information Security policies, standards, processes and controls to protect the confidentiality, integrity and availability of AWN business information (in accordance with our employee handbook and corporate policies)
• Background checks are required for this position
• This position may require access to information protected under U.S. export control laws and regulations, including the Export Administration Regulations (“EAR”)
• Please note that, if applicable, an offer for employment will be conditioned on authorization to receive software or technology controlled under these U.S. export control laws and regulations

Desirable

• The Incident Response (IR) Engagement Manager is the Client, Counsel, and Partner(s)’s main point of contact throughout the engagement. They are responsible for the overall quality of each IR engagement
• Be the primary person scoping out new engagements for various types of engagements including but not limited to pre-ransomware, ransomware, network intrusion, website compromise, malware infection, business email compromise, insider threat and similar type incidents
• Generate and, when necessary, revise IR Statement of Work (SOW), BAA, Service Agreement (SA), Attestation letter, insurance carrier form(s) and similar type documents
• Lead assigned incident response engagements through the whole case lifecycle and be responsible for Client, Carrier, Counsel, and Partner(s) satisfaction and delivering of high quality work product
• Manage budgets on all cases, and provide SOW amendments along with reasons the amendment is needed to Client/Carrier/Counsel before we go over budget. Follow up with Client/Carrier/Counsel to make sure they understand why the amendment is needed and they remain satisfied with our work
• Work with Incident Response team managers to assign the correct team members to each case to meet the Client’s needs and balance utilization across the team
• Regularly view individual time entries to assigned cases to ensure proper entries are being made
• Ensure cases are properly staffed through nights, weekends, holidays and personal time off
• Provide, or have another IR team member provide, daily updates to Client/Counsel surrounding the current status of all workstreams on the case, via email and phone call (if necessary)
• Communicate regularly with technical and non-technical executives from Client/Counsel/Carrier/AW Partners, and smooth over any issues/concerns that may arise from any of those parties
• Lead (with team collaboration) the creation and execution of the overall incident response plan for containment, evidence preservation, root cause analysis, remediation, restoration, data compromise investigation and threat actor communications
• Collaborate with internal AW teams and patterns to ensure we transition IR clients to long term MDR services
• Participate in weekday EM office hours
• Participate in weekday EM escalation on call schedule
• Participate in weekend EM on call schedule
• Participate in holiday EM on call schedule
• Participate in IRJS IR Planner reviews
• Participate in Client tabletop exercises
• Ensure timing of goals for milestones on each case are met to the best of our ability:
• Statement of Work delivered (within 30 minutes of scoping call)
• IR Kick-Off Email Sent (within 30 minutes of signed SOW)
• Containment has begun (within 2 hours of signed SOW – may require full network quarantine)
• Root cause identification (within 24 hours of engagement, or as soon as possible)
• Remediation of root cause and persistence (within 36 hours after start of engagement)
• Critical systems restored (goal of 5 days)
• Data compromise investigation findings delivered (10 days or less)
• Final findings delivered (within 30 days or less)
• Internal data tracking verified, and any necessary carrier reports are completed (throughout the engagement, but within 30 days or less)
• MDR sales introduction (within 30 days or less)
• Offboarded Completely (within 60 days)
• Data return deletion (within 60 days)