Incident Response & Forensics Lead

Start free →

Or apply yourself on the official page →

About the role

At Anaplan, we are a team of innovators focused on optimizing business decision-making through our leading AI-infused scenario planning and analysis platform so our customers can outpace their competition and the market. What unites Anaplanners across teams and geographies is our collective commitment to our customers’ success and to our Winning Culture. Our customers rank among the who’s who in the Fortune 50. Coca-Cola, LinkedIn, Adobe, LVMH and Bayer are just a few of the 2,400+ global companies who rely on our best-in-class platform. Our Winning Culture is the engine that drives our teams of innovators. We champion diversity of thought and ideas, we behave like leaders regardless of title, we are committed to achieving ambitious goals, and we love celebrating our wins – big and small. Supported by operating principles of being strategy-led, values -based and disciplined in execution, you’ll be inspired, connected, developed and rewarded here. Everything that makes you unique is welcome; join us and let’s build what’s next - together! Role Summary: As Anaplan's Incident Response & Forensics Lead, you will lead and improve how we investigate, respond to, and learn from security incidents. This is a senior, hands-on role that combines deep digital forensics and incident response expertise with strong threat intelligence knowledge. You will lead complex investigations, perform forensic analysis, conduct threat hunting, and leverage intelligence to understand who we are up against and how they operate. You'll help build a mature, intelligence-driven IR capability grounded in a clear understanding of who targets organisations like ours and how they operate, including state-sponsored actors, well-resourced criminal groups, and attackers making growing use of AI. Your Impact: • Act as technical lead on our highest-severity incidents, owning the investigation end-to-end, from triage and scoping through containment, eradication, recovery, and post-incident review • Perform digital forensic analysis across endpoints, servers, cloud, SaaS, and identity environments, preserving evidence and reconstructing attacker activity and timelines • Apply an intelligence-driven approach to investigations, using what you find to understand adversary tradecraft, likely objectives, and related activity, and using that understanding to guide scoping and response decisions • Work alongside legal, privacy, and communications teams during major incidents, and with external incident response partners where needed • Lead proactive, hypothesis-led threat hunts informed by investigation findings, intelligence, and emerging tradecraft, and turn the results into tested, high-fidelity detections • Produce internal threat reporting that translates what we're seeing in our environment, and across the threat landscape relevant to us, into clear assessments and actions for security teams and leadership • Shape our threat intelligence capability, including intelligence requirements and the sources and tooling that support them, keeping it directly connected to investigation, hunting, and detection work • Expand incident response playbooks, forensic procedures, and evidence handling standards, raise the standard of how we run complex investigations, and coach SOC analysts through live investigations • Use AI as a core part of how you work, building and applying AI-assisted workflows and automation for evidence collection, enrichment, triage, and analysis, and integrating them with our security tooling Your Skills: • Extensive hands-on experience in digital forensics and incident response, including leading complex, high-severity investigations across hybrid, cloud, and SaaS environments • Practical forensic skills across endpoint, memory, network, log

View the official posting →