Cybersecurity Incident Response Lead

The role

You will lead the detection, investigation, containment, and recovery of cybersecurity incidents affecting infrastructure, engineering, manufacturing, and aerospace data. This is a hands-on technical leadership role involving complex investigations and coordination across multiple teams.

What you will do

• Lead cybersecurity incidents from triage through closure
• Serve as technical incident lead and coordinate responders
• Investigate endpoint, identity, network, cloud, and application activity
• Collect and preserve logs and forensic artifacts
• Coordinate containment and recovery with system owners
• Maintain the incident response plan, escalation procedures, and playbooks
• Improve detection coverage and response workflows
• Conduct threat hunting and translate findings into detection rules
• Provide incident updates and reports to stakeholders
• Coordinate with leadership, legal, compliance, and external partners

Required qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent practical experience
• 5+ years of experience in cybersecurity operations, incident response, digital forensics, or a related technical field
• Hands-on leadership of complex security incidents
• Ability to investigate and contain security incidents and coordinate recovery
• Strong understanding of Windows and Linux systems, identity and access management, networking, and cloud infrastructure
• Hands-on experience with SIEM and endpoint detection and response platforms
• Ability to write investigation queries and automate tasks using KQL, Python, PowerShell, or Bash
• Clear written and verbal communication skills

Nice to have

• Experience with Microsoft Sentinel, Defender, Entra ID, Microsoft 365, and investigations in AWS or Azure environments
• Experience with disk and memory forensics, malware triage, threat hunting, or investigations involving ransomware, identity compromise, and data theft
• Experience building an incident response program, running exercises, or coordinating external incident response providers
• Familiarity with MITRE ATT&CK and incident response practices aligned with NIST
• Experience supporting NIST 800-53/171, FedRAMP, ISO 27001, SOC 2, or CUI protection requirements
• Experience supporting aerospace, manufacturing, operational technology, or other environments where response actions must account for safety and availability
• Relevant certifications such as GCIH, GCFA, GCFE, or equivalent demonstrated expertise
• Prior experience in a startup environment

Benefits

• Equity in the form of stock options
• Subsidized medical, dental, and vision insurance
• Company-paid life and disability insurance
• 401(k) plan with employer match
• 4 weeks’ Paid Time Off
• 11 days of holidays including an end-of-year closure
• Paid Family/Parental Leave
• On-site gym or monthly wellness stipend (depending on location)
• Dog friendly offices

Before you apply

• Must be a U.S. citizen, lawful permanent resident of the U.S., or protected individual as defined by 8 U.S.C. 1324b(a)(3)
• Employment is contingent upon satisfactory completion of reference and background checks
• Must be able to prove identity and authorization to work in the U.S.
• Employment may be conditioned on legal authorization to work with or have access to export control materials

About the company

Stoke is building Nova, a fully and rapidly reusable launch vehicle designed for daily flight. The team is mission-driven, collaborative, and focused on creating a scalable space industry.