Lead Service Manager - Incident Response Analyst

Skip to main content Saved jobs(0) - DescriptionOPENTEXT - THE INFORMATION COMPANYOpenText is a global leader in information management, where innovation, creativity, and collaboration are the key components of our corporate culture. As a member of our team, you will have the opportunity to partner with the most highly regarded companies in the world, tackle complex issues, and contribute to projects that shape the future of digital transformation. AI-First. Future-Driven. Human-Centered.At OpenText, AI is at the heart of everything we do—powering innovation, transforming work, and empowering digital knowledge workers. We are hiring talent AI can't replace to help us shape the future of information management. Join us. As a global leader in secure information management, OpenText empowers businesses to stay ahead of the ever-evolving cyber threats. Our Cybersecurity Enterprise portfolio is formidable, offering innovative solutions that safeguard organizations from malicious attacks, data breaches, and cyber vulnerabilities. By joining our team, you'll be at the forefront of developing and implementing state-of-the-art security technologies, protecting critical assets and sensitive information for clients worldwide. Your Impact The Lead Service Manager is a senior technical practitioner within the MSS SOC and CSIRT function, responsible for leading and delivering incident response engagements across the organization’s multi-tenant managed security client base. This role provides dedicated capacity for the Incident Response retainer service, ensuring clients receive rapid, expert-led containment, investigation, and remediation when security incidents occur. Operating within an MSS environment serving SMB clients, the Senior IR Analyst works alongside the existing CSIRT and DFIR capability to ensure retainer commitments are met without degrading day-to-day detection and response operations. The role demands a practitioner who can operate independently under pressure, communicate clearly with client stakeholders, and contribute to the continuous improvement of the MSS incident response capability. This role is critical to maintaining client trust and delivering high-confidence incident response outcomes across the MSS portfolio. As a Lead Service Manager, you will: Lead Incident Response (IR) retainer engagements, directing containment, eradication, recovery, and incident triage activities across client environments.Investigate security incidents including ransomware, BEC, data exfiltration, insider threats, and APTs through remote and on-site response engagements.Coordinate incident response efforts with client IT teams, legal counsel, insurers, regulators, and stakeholders in accordance with MSOD requirements.Deliver professional incident reports, root cause analyses, and post-incident review (PIR) documentation.Maintain chain-of-custody procedures for digital evidence and support forensic investigations with legal or regulatory implications.Perform digital forensic investigations across Windows, Linux, macOS, Microsoft 365, Azure AD/Entra ID, AWS, and Google Workspace environments.Analyze memory, disk, log, network, and cloud audit data to determine incident scope, impact, root cause, and develop IOCs.Utilize EDR tools and threat-hunting techniques to identify adversary activity, trace lateral movement, and support containment decisions.Serve as an escalation point for SOC analysts, providing mentorship, investigation guidance, and contributing to IR playbooks, runbooks, TTX, and purple team exercises.Communicate incident status, impacts, PIR findings, and strategic recommendations effectively to both technical and executive stakeholders. What you need to Succeed: 5+ years of progressive cybersecurity experience, including 3+ years in hands-on Incident Response (IR), DFIR, or senior SOC analyst roles.Proven experience leading incidents through the...