Incident Response Process

Understands basic Incident Response Process concepts. Follows security guidelines. Recognizes common vulnerabilities in code.

Follows the security incident process: detection, escalation, documentation. Collects evidence during security events. Participates in post-incident analysis.

Understands basic Incident Response Process concepts. Follows security guidelines. Recognizes common code vulnerabilities.

Follows incident response process: escalation by severity, communication in dedicated channels. Documents incident timeline. Participates in post-mortem reviews.

Supports incident response by providing offensive security expertise during active incidents. Validates attack vectors and helps determine scope of compromise. Documents exploitation paths for post-incident analysis and contributes to lessons-learned reviews with remediation recommendations.

Manages security incidents: severity classification, containment actions, root cause analysis. Creates security incident runbooks. Documents lessons learned and improvement actions.

Executes incident response procedures including detection, containment, and initial investigation. Classifies incidents by severity using established criteria and escalates appropriately. Performs log analysis and IOC correlation in SIEM to determine attack scope and impact on affected systems.

Manages incidents: severity classification, stakeholder communication, cross-team coordination. Conducts root cause analysis. Leads post-mortems with actionable follow-ups.

Leads purple team exercises to validate and improve incident response capabilities. Designs attack simulations that test detection and response workflows end-to-end. Integrates offensive findings into incident response playbooks and mentors the team on attacker TTPs relevant to detection engineering.

Designs security incident response: automated detection (SIEM correlation), playbooks for typical incidents, forensics capabilities. Integrates with vulnerability management.

Leads incident response for complex multi-vector security incidents across cloud and on-premise environments. Conducts advanced threat hunting and root cause analysis. Develops and refines incident response playbooks based on emerging threats. Mentors team on incident handling and coordinates with external stakeholders.

Designs incident response process: automated severity detection, runbook automation, war room orchestration. Implements SLO-based alerting for proactive incident detection.

Defines offensive security's role in the incident response process across the organization. Establishes red team/purple team exercise programs that systematically test incident response maturity. Coordinates with SOC leadership on improving detection coverage based on real-world attack simulation results.

Defines security IR standards: incident classification, escalation matrix, communication plan. Conducts tabletop exercises. Coordinates cross-team incident response.

Defines the organization's incident response framework including team structure, escalation paths, and communication plans. Establishes incident classification standards, SLAs for response times, and post-incident review processes. Coordinates tabletop exercises and drives continuous improvement of IR capabilities.

Defines incident management standards: severity matrix, communication templates, post-mortem requirements. Implements incident metrics (MTTD, MTTR). Trains teams on incident response.

Shapes enterprise security posture by aligning offensive testing programs with incident response maturity models. Drives industry-level contributions to attack simulation frameworks and adversary emulation standards. Advises executive leadership on threat landscape trends and organizational readiness for advanced persistent threats.

Designs organizational security IR capability: SOC integration, threat intelligence-driven response, automated remediation. Defines security incident management maturity model.

Defines enterprise-wide incident response strategy aligned with business risk management and regulatory requirements. Shapes the security operations architecture including SOAR, threat intelligence, and automated response capabilities. Represents the organization to regulators, partners, and industry bodies on incident management practices.

Designs incident management platform: automated triage, cross-team coordination, incident learning system. Defines organizational incident culture and continuous improvement process.