Incident Response Lead
asymmetricsecurityNew York (NY)
Incident Response Lead
Posted yesterday
asymmetricsecurityNew York (NY)
SENIORITY
Lead
About the role
The last great shift in computing, the cloud, created a new generation of giants in DFIR, like Crowdstrike. The next great shift—AI—will be even bigger. It will create new giants. We are building one of them. Asymmetric is the world's first AI-native DFIR lab. We build human-AI analyst teams designed from the ground up to redefine the next generation of DFIR. Our AI agents take on the repetitive, laborious work, freeing analysts to focus on the most challenging and critical parts of investigations. Our first AI agent is already live, running Business Email Compromise (BEC) investigations for a DFIR partner as part of a six-figure contract. We are backed by a $4.2M investment by some of the world's best investors, including Susa Ventures, Matt Clifford, Charlie Songhurst (Meta board member), and Geoff Ralston.
About the role:
We are assembling a world-class team and are looking for a talented and ambitious Incident Response Lead to shape how DFIR is done in the AI era. You will lead technically challenging forensic work and grow into a key technical leader at Asymmetric. You will be supported by an AI engineering team dedicated to automating the least interesting parts of your job, freeing you to focus on what matters most: solving the most complex analytical challenges within each case. This is a role on the founding team that comes with significant responsibility. We will pay exceptionally well for top performers.
Responsibilities:
- Lead investigations including business email compromise, ransomware, network intrusions, and insider threats. Your initial focus will be on cloud-based email attacks across Google and Microsoft environments.
- Build defensible timelines and substantiate findings across log sources.
- Take challenging forensic problems, including uncovering novel attack paths.
- Codify best practices, contributing to case handbooks.
- Partner with the engineering team to develop AI DFIR tools.
- You may be a fit if you:
- Have significant experience in major incident investigations and forensic analysis efforts.
- Have investigated cloud-based attacks in Microsoft and/or Google Workspace.
- Are skilled in developing playbooks and analysis plans for complex forensic investigations.
- Can communicate technical findings clearly with key stakeholders and team members.
- Excited about uncovering novel threat actor TTPs.
Before you apply
Applying takes about a minute. These four things decide how fast it moves after that.
Your profile is current
It's what we read first. Occupations, seniority and locations matter more than a long history.
Two examples you can talk through
Not a portfolio — just two pieces of work where you can explain the decisions and what you'd change.
A number in mind
What you're on now and what would make you move. We negotiate better when we know both.
Your notice period
Employers plan around it, and it's the question that stalls offers most often.
Once you apply, someone reads it and calls you before anything reaches the employer — usually within two working days.