Senior Incident Responder

BlackCloak is seeking a seasoned and highly skilled Senior Incident Responder to join our Technical Success Team. This is a senior, client-facing individual contributor role for someone who has spent years on both sides of the problem: the technical compromise of computers, phones, and online accounts, and the financial fraud that so often follows it. In this critical role, you will serve as the primary escalation point and lead investigator for complex security events; taking ownership of the full incident response lifecycle, from initial triage and containment through eradication, recovery, and post-incident reporting.

Our clients are executives, board members, and high-profile individuals whose personal accounts and devices are targeted precisely because their corporate ones are hard to breach. When something goes wrong in a client's personal digital life, you are the person who takes the call, works the incident end to end, and stays with them until it is resolved. You will also help us get better at preventing the next one: mapping how each incident unfolded against both the cyber attack kill chain and the personal attack kill chain, closing the gaps that made it possible, and mentoring the responders behind you.

If you excel at guiding clients through high-stress situations, possess deep technical expertise in digital forensics, and have a proven track record of handling sophisticated threats targeting high-profile individuals, this is an opportunity to elevate your career and make a tangible impact.

• 5-8+ years of experience in a dedicated Incident Response, Digital Forensics (DFIR), or advanced cybersecurity analyst role.

• Proven track record executing the full incident lifecycle, particularly involving personal/executive account takeovers, mobile threats, and endpoint malware.

• Demonstrated experience investigating fraud in financial transactions, including direct coordination with banks and credit card companies - fraud investigation, disputes and chargebacks, transaction analysis, or account takeover response. This may have been gained at a financial institution, card issuer, payment processor, fintech risk team, financial crimes unit, or in a security role working these cases directly.

• Deep technical expertise conducting forensics and vulnerability management across Windows, macOS, iOS, Android, and Linux ecosystems.

• Working command of identity theft remediation and attack kill chain models, with the ability to apply them to an individual and their family rather than an enterprise network.

• Advanced industry certifications are highly preferred (e.g., GCIH, GCFA, CISSP, OSCP, or similar); fraud and financial crime credentials such as CFE, CFCS, or CAMS are a strong plus.

• Exceptional communication skills with the ability to translate technical jargon into actionable advice for non-technical clients, maintaining deep empathy and composure during high-stress crises.

• College degree in an Information Technology (IT/CS/CE) discipline or equivalent real-world experience, coupled with the ability to operate highly independently.