About The Role
What if your hard-won experience in the SOC trenches could directly strengthen how organizations detect, respond to, and contain real threats? We're looking for a seasoned Incident Response Lead to independently evaluate SOC operations — reviewing detection workflows, stress-testing playbooks, and surfacing the gaps that keep security teams up at night.
This is a fully remote, flexible contract engagement. If you've lived through real incidents, built response processes from scratch, or spent time hunting for what others missed — this is work that will feel both familiar and meaningful.
Type: Hourly Contract
Location: Remote
Commitment: Flexible
What You'll Do
Evaluate detection alert pipelines, triage workflows, and escalation pathways for quality and consistency
Assess the completeness and effectiveness of incident response actions across real or simulated timelines
Identify critical gaps in logging coverage, detection logic, and containment procedures
Review and validate incident response playbooks for clarity, accuracy, and operational feasibility
Summarize recurring incident patterns and pinpoint operational bottlenecks
Support ongoing assessments of SOC maturity and overall response readiness
Deliver structured, analytical documentation that drives actionable improvements
Must-Have
Who You Are
Hands-on experience in SOC operations, incident response leadership, or cybersecurity operations
Strong working knowledge of detection engineering, response workflows, and incident lifecycle management
Sharp analytical thinking with the ability to translate findings into clear, structured written assessments
Comfortable working independently and delivering consistent, high-quality evaluations
Nice To Have
Familiarity with SIEM platforms (e.g., Splunk, Sentinel, Chronicle)
Experience with EDR tools and cloud-native detection systems
Background in threat intelligence, purple teaming, or adversary simulation
Relevant certifications such as GCIH, GCFA, CISSP, or equivalent
Why Join Us
Apply deep security expertise to work that has a real, measurable impact on organizational resilience
Fully remote and flexible — complete assessments on a schedule that works for you
Freelance autonomy with meaningful, structured task-based work
Engage with a diverse range of SOC environments, toolsets, and operational challenges
Potential for ongoing work and contract extension across new assessments and engagements