Incident Response Lead

<div class="content-intro"><p><strong>Build the Future with AspenView Technology Partners</strong></p> <p>At AspenView, we are passionate about transforming the way organizations approach technology. We specialize in creating high-performing, nearshore IT teams to help North American clients innovate faster and more efficiently.</p> <p>As we continue to grow, we’re looking for exceptional people to join our team and help drive impactful change across industries.</p></div><p> </p> <p><strong>Why Join AspenView?</strong></p> <p>At AspenView, we’re more than a nearshore IT partner—we’re a <strong>people-first, purpose-driven</strong> company that believes great culture drives great outcomes. We’re passionate about connecting talent and technology to deliver measurable value for clients—and meaningful career paths for our people.</p> <p>Here’s what you can expect:</p> <ul data-pattern="discCircleSquare" data-depth="1"> <li>Competitive base</li> <li>Flexible work model: hybrid, remote, or in-office</li> <li>Real growth opportunities and leadership visibility</li> <li>Inclusive, respectful culture that blends U.S. innovation with Colombian heart</li> <li>A company that listens, invests in you, and celebrates wins together</li> </ul> <p> </p> <p>The <strong>Incident Response Lead</strong> is a <em><strong>senior</strong></em>, hands-on professional responsible for leading incident response and the embedded digital forensics capability for a large US consumer lender. The client's 24/7 security operations run from a nearshore team in Bogotá, Medellin and Buenos Aires, and you will be one of two US-based seniors on the service, highly visible to the client's security leadership. When the client declares a major incident, you will be the incident lead on its bridge. The client declares incidents and executes containment; your job is to tell it what happened, how far it reached and what to contain, with the evidence to back it. You will report to the SOC / Cyber Operations Lead and provide technical direction to two Tier 3 analysts in Latin America.</p> <p>What you will do:</p> <p><strong>Major Incident Leadership</strong></p> <ul> <li>Serve as incident lead on the client's major-incident bridge, working alongside its incident commander and keeping the client, the partner and the analysts aligned on one version of events.</li> <li>Scope incidents and deliver evidence-backed containment recommendations for the client's infrastructure, identity, endpoint and application teams to execute.</li> <li>Write operational updates for responders and executive summaries for client leadership during incidents, and lead the post-incident review afterwards.</li> </ul> <p><strong>Digital Forensics & Investigation</strong></p> <ul> <li>Own the DFIR work inside the service, including host and memory triage and analysis of CrowdStrike and Defender endpoint telemetry.</li> <li>Investigate Okta sessions and tokens, and AWS activity through CloudTrail, GuardDuty and VPC flow logs.</li> <li>Build investigation records and timelines that give the client what it needs for its own regulatory notification decisions under NYDFS Part 500 and GLBA.</li> </ul> <p><strong>Readiness & Team Direction</strong></p> <ul> <li>Develop IR playbooks and runbooks, including a review of the client's existing content.</li> <li>Run tabletop exercises with the client's security, legal and risk teams.</li> <li>Guide two Tier 3 analysts in Latin America who act as your first line on overnight investigations.</li> </ul> <p>Tools & Technologies:</p> <ul> <li><strong>SIEM & Case Management:</strong> Elastic, Abstract Security and ServiceNow SecOps (Splunk or Sentinel also relevant).</li> <li><strong>Endpoint & Identity:</strong> CrowdStrike Falcon, Microsoft Defender and Okta (or Entra ID).</li> <li><strong>Cloud:</strong> AWS CloudTrail, GuardDuty and VPC flow logs (Azure or GCP accepted).</li> <li><strong>Email & Network (Bonus):</strong> Proofpoint and Palo Alto, or equivalents.</li> <li><strong>Forensics (Bonus):</strong> Velociraptor, KAPE, Volatility, FTK, EnCase or X-Ways.</li> </ul> <p>What you bring:</p> <ul> <li><strong>Experience:</strong> Senior enough to lead the technical response to a major incident, and able to walk through one end to end, including what went wrong and what you changed afterwards. Hands-on forensics on Windows and Linux hosts and investigations in at least one major cloud.</li> <li><strong>Technical Independence:</strong> You query SIEM, EDR and identity logs directly rather than waiting for an analyst to pull the data.</li> <li><strong>Judgment:</strong> The ability to recommend containment that stops an attacker without taking down a lending platform at month end.</li> <li><strong>Communication / Leadership:</strong> Incident reports that a CISO, a lawyer and an examiner can each read without a translator. Proven ability to lead people you don't line-manage, including analysts in another country.</li> <li><strong>Availability:</strong> Remote work from the United States on US Eastern business hours, plus a 24/7 on-call rotation and periodic travel to the client and to Bogotá and Buenos Aires. US work authorization is required, a