Senior Cybersecurity Incident Responder

At U.S. Bank, we’re on a journey to do our best. Helping the customers and businesses we serve to make better and smarter financial decisions and enabling the communities we support to grow and succeed.  We believe it takes all of us to bring our shared ambition to life, and each person is unique in their potential. A career with U.S. Bank gives you a wide, ever-growing range of opportunities to discover what makes you thrive at every stage of your career. Try new things, learn new skills and discover what you excel at—all from Day One. Job Description This position is not eligible for visa sponsorship. Location expectations: This role requires working from a U.S. Bank location three (3) or more days per week. U.S. Bank is seeking a Senior Cybersecurity Incident Responder to join our Cybersecurity Incident Response team. This position is responsible for investigating escalated cybersecurity events, performing hands-on technical analysis, and determining the scope, impact, and root cause of security incidents. This person will serve as a senior hands-on incident responder responsible for taking security events beyond initial SOC triage and independently investigating them through resolution. This person will analyze logs and security telemetry, perform digital forensic analysis, leverage SIEM and Endpoint Detection and Response (EDR) technologies, and investigate suspicious activity across endpoints, networks, web applications, firewalls, and other security controls. The ideal candidate has significant hands-on incident response experience and can independently analyze technical evidence to determine what occurred during a cybersecurity incident. Main Responsibilities: • Lead hands-on investigation of escalated cybersecurity events and incidents. • Determine whether suspicious activity represents a confirmed cybersecurity incident. • Analyze security logs, alerts, events, and telemetry to identify malicious or anomalous activity. • Reconstruct incident timelines and determine attack vectors, scope, impact, and root cause. • Perform digital forensics and technical analysis in support of cybersecurity investigations. • Use Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) platforms during active investigations. • Investigate suspicious activity involving endpoints, networks, web applications, firewalls, and other security technologies. • Identify indicators of compromise (IOCs) and other evidence associated with malicious activity. • Document investigation findings and communicate technically supported conclusions. • Collaborate with SOC analysts and other cybersecurity teams during complex or significant incidents. • Support containment, remediation, and recovery activities as appropriate during cybersecurity incidents. • Participate in an on-call rotation approximately every 4-6 weeks and provide after-hours support for significant cybersecurity incidents. Must Have Skills: • 4+ years of relevant hands-on cybersecurity Incident Response, Incident Handling, or Digital Forensics and Incident Response (DFIR) experience. • Demonstrated experience personally investigating cybersecurity incidents from escalation through conclusion. • Strong security log analysis and security telemetry investigation skills. • Hands-on experience using Security Information and Event Management (SIEM) platforms. • Hands-on experience using Endpoint Detection and Response (EDR) technologies. • Experience with digital forensics, cyber investigations, or forensic analysis. • Knowledge of network security concepts, protocols, and network activity analysis. • Experience investigating security activity across endpoints, networks, web applications, firewalls, and related security controls. • Abili