Incident Response Lead

About this role

Harbor IT is a national provider of managed IT, cybersecurity, AI, and cloud services, built for organizations running complex, regulated, and mission-critical environments. Harbor was formed by bringing together specialized technology firms rather than by acquiring generalists, which is why our engineering bench runs deeper across more domains than a typical managed service provider. Cybersecurity is not a product line we added. We started as a security company, and security is built into every service we deliver.

Our practices concentrate on industries where failure is not an option: critical infrastructure across oil and gas, agriculture, manufacturing, and transportation; multi-site healthcare and life sciences; and private equity portfolio companies and serial acquirers. We run a 24/7/365 Security Operations Center staffed entirely in the United States.

Our Managed Detection and Response practice, formerly Quadrant Information Security, combines security technology with in-house cybersecurity talent to deliver 24/7 monitoring, detection, and response across customer environments. The platform is built on Sagan, our proprietary detection and correlation engine.

This is a new role, and it exists because Harbor manages the systems attackers land in: email, identity, endpoints, servers, firewalls, backups, and the help desk that touches all of them. When a client is compromised we are the first call and the only party with hands already on the environment, but Harbor does not perform deep digital forensics and does not intend to. You will own the first hours instead: triage, scoping, containment decisions, straight answers for executives, and the judgment call about what Harbor handles end to end versus what gets handed to an outside DFIR firm, breach counsel, or an insurance panel. You are the incident commander, directing Harbor’s SOC analysts, security engineers, infrastructure teams, and help desk during a live event, and you will build the practice that supports it: the severity model, the playbooks, the escalation matrix, the client-facing report format, and the tabletops that test all of it before a real incident does. You report to the Senior Director of Cyber Services and work alongside the SOC Manager, the Director of Deployments and Engineering, Client Success, and the account teams who own the client relationship.

Key Responsibilities

Incident Command

• Serve as incident commander for client security incidents: establish scope, set response priorities, assign actions to named owners, track decisions, and keep the incident moving when the environment is unfamiliar and the data is incomplete.

• Run triage and initial investigation across the environments Harbor manages, including Microsoft 365 and Entra ID, Active Directory, endpoints under EDR, servers, firewalls, and the Sagan-based detection pipeline and its alert history. Often times delegating information gathering to internal resources while you focus on the things only you are capable of.

• Own containment decisions and their consequences: what gets isolated, what credentials get reset, what gets left running to preserve evidence, and who at the client has authority to approve each one.

• Make and defend the escalation call. Own the incidents that sit inside Harbor’s scope from detection through post-incident reporting, including business email compromise, single-host malware, and bounded credential compromise. When an incident exceeds that scope, brief the receiving DFIR firm and hand off with a written timeline and evidence inventory rather than a phone call and a shrug.

• Carry on-call responsibility. Incidents do not respect business hours, and this role requires availability outside them.

Stakeholder Communication

• Be the voice clients hear during the worst week of their year. Translate technical findings into decisions an owner, executive, or general counsel can act on, without overstating certainty and without hiding behind jargon.

• Coordinate with breach counsel, cyber insurance carriers and their panel firms, third-party DFIR teams, client internal IT, and law enforcement where applicable, and keep Client Success and leadership current on active incidents.

• Produce the post-incident report: what happened, what was confirmed versus assumed, what was contained, what remains open, and what the client should change.

Building the Practice

• Write and maintain Harbor’s incident response playbooks, severity model, and escalation matrix, and define in writing where Harbor’s responsibility begins and ends so the boundary holds up in a contract and under pressure.

• Build named working relationships with outside DFIR firms and breach counsel practices so handoffs start warm instead of starting with introductions.

• Maintain an escalation-readiness record for every managed client: who holds an IR retainer, who holds cyber insurance and with which carrier, who has named counsel, and who has nothing.

• (When applicable/feasible) Run tabletop exercises with Harbor teams and with clients, and turn what breaks in those exercises into playbook changes.

• Mentor SOC analysts and security engineers on investigative method and incident discipline, and feed lessons from real incidents back to detection engineering so the same intrusion gets caught earlier next time.

Required Qualifications & Skills

Experience & Education

• 6+ years in cybersecurity, with substantial time spent responding to real intrusions rather than monitoring for them.

• Direct experience acting as the lead on security incidents, meaning you set the direction and other people executed against it. Participation on an IR team is not the same thing.

• Experience responding across multiple distinct organizations, whether from a consulting, MSSP, MDR, or panel DFIR background. This role sees a different environment every time.

Technical Depth

• Hands-on investigative depth in Microsoft 365, Google Workspace, and Entra ID compromise:…