Incident Response Analysis Manager

Job Summary

Meet the Team

The Advanced Response Team (ART) leads Splunk s response to cybersecurity incidents affecting Splunk product infrastructure. ART partners with engineering and business teams to contain incidents, determine root cause, and drive lasting remediation that reduces risk across Splunk. ART is a collaborative, security-first team that values sound judgment, clear communication, continuous learning, and a supportive work environment. In this India-based role, you will expand ART s global coverage, lead complex incidents, mentor analysts, and shape team-wide response practices during a shift that includes periods of independent coverage.

Your Impact

Command the response to complex cybersecurity incidents affecting Splunk product infrastructure, coordinating technical and business teams from initial containment through remediation. Direct investigations to reconstruct events, identify malicious activity, determine root cause, and establish near- and long-term corrective actions. Provide technical leadership and mentor analysts to strengthen investigative judgment and response readiness across ART. Represent ART to business leaders by translating technical findings into clear assessments of incident impact, risk, and required remediation. Build ART s response program by developing department-wide processes and repeatable playbooks that improve incident resolution, global handoffs, and long-term security outcomes.

Minimum Qualifications

• 7+ years of professional Information Technology or information security experience, including four or more years leading responses to concurrent, complex, or large-scale cybersecurity incidents.
• Practical experience investigating incidents in Linux, public cloud, and containerized or Kubernetes-orchestrated environments. Experience analyzing identity and access management (IAM) activity, CI/CD pipelines, software supply chain telemetry, and Security Information and Event Management (SIEM) data.
• Proven technical depth in at least two of the following areas: digital forensics, software supply chain security, cloud or container incident response, detection engineering, threat hunting, identity security investigations, network forensics, or malware analysis or reverse engineering.
• Experience evaluating and implementing AI-assisted workflows for cybersecurity incident triage, investigation, analysis, or reporting, including controls for output validation and sensitive data handling.
• Experience serving as a technical lead, mentoring analysts, and creating or validating department-wide incident response processes.

Preferred Qualifications

• Experience translating highly technical incident findings into clear, actionable guidance for nontechnical audiences.
• Experience prioritizing concurrent response activities, making time-sensitive decisions, and leading teams during high-pressure incidents.
• Experience responding to software supply chain incidents involving source control, CI/CD pipelines, artifact registries, or deployment systems.
• Experience building or operating Kubernetes environments and establishing the supporting cloud infrastructure, security telemetry, and forensic capabilities.
• Experience with artificial intelligence technologies in security operations, including investigating or mitigating security risks involving AI applications, models, agents, AI-generated code, or third-party AI services.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.