IT Incident Response Engineer - Digital Forensics & Incident Response Manager

This senior global security operations role leads complex cyber incident response and digital forensics investigations across all regions. The position serves as the primary incident response point of contact for Japan while coordinating response activities for corporate offices, manufacturing plants, and research and development facilities. It also leads Japan-based response activities and acts as the delegated incident response lead when the US-based Incident Response Leader is unavailable.

The role directs 15–20 offsite contractors during Japan business hours and manages coordination with managed service providers, third-party incident response firms, and other external stakeholders. Responsibilities include overseeing service delivery, including SLAs and KPIs, and leading investigations involving endpoints, servers, networks, cloud environments, and mobile devices. The position conducts digital forensic examinations, malware analysis, incident analysis, containment and recovery activities, and post-incident reporting. It also develops and maintains IT, OT, and ICS incident response playbooks, tabletop exercises, operating procedures, and forensic response processes. Additional work includes security monitoring and analysis in a GSOC or SIEM environment, threat intelligence analysis, and continuous improvement of workflows and response capabilities.

Applicants are expected to have at least 10 years of progressive cybersecurity experience, including at least 5 years in hands-on incident response or digital forensics. Required experience includes leading complex enterprise-scale incidents such as ransomware, data breaches, insider threats, and advanced persistent threats. Hands-on experience should cover endpoint forensics on Windows, Linux, and macOS; memory and network forensics; log analysis; malware triage; and cloud forensics using Azure, AWS, or GCP. Experience supporting OT/ICS environments or the IT security of manufacturing or R&D facilities, working with a SOC or global SOC, and managing external contractors, managed service providers, or third-party incident response firms is expected. Security automation and scripting experience using Python, PowerShell, Ruby, or similar languages is also required. Familiarity with blockchain and cryptocurrency transaction tracing for ransomware and fraud investigations is also relevant.

The incident response and forensics toolchain includes CrowdStrike, Splunk, Microsoft Sentinel, Velociraptor, Magnet AXIOM, X-Ways, Volatility, ELK, and Osquery. Certifications include GCIH, GCFA or GCFE, GCED, CISSP, EnCE, and CISM.

The work locations are the Japan headquarters in Hachioji, Tokyo, and a satellite office in Nishi-Shinjuku, Shinjuku-ku, Tokyo. Telework is available.

A flextime system without core hours, a telework system, 129 annual holidays, 20 days of annual paid leave, and statutory social insurance are stated.