Citi's Cloud Incident Response (Cloud IR) team is seeking an expert Cloud Incident Responder (VP) to take a leading role in strategically managing and responding to security incidents across our vast and dynamic technology landscape. You will be at the forefront of protecting Citi's critical assets, including our multi-cloud environments on AWS and GCP, and vital data platforms like Snowflake and Databricks. Your leadership will be crucial in safeguarding the integrity of our services and the trillions of dollars that flow through our network daily. 

In this role, you will work with global stakeholders to drive the evolution of our security processes, procedures, and cutting-edge tools. You will ensure the firm is prepared to meet the most critical security challenges in an evolving cloud ecosystem.

Responsibilities: 

As a Cloud Incident Responder, you will perform a full range of incident response functions, including but not limited to: 

• Lead and Build Response Automation: Architect, refine, and champion the development of cutting-edge incident response playbooks and automation capabilities, with a primary focus on enhancing our response mechanisms for Databricks and Snowflake. 

• Conduct In-Depth Investigations: Perform detailed, cloud-focused investigations by analyzing logs and telemetry from Cloud Service Providers (AWS, GCP), data platforms (Snowflake, Databricks), and enterprise SaaS applications (M365). 

• Orchestrate Forensic Analysis: Coordinate the execution of automated workflows to gather critical forensic artifacts (memory, disk, cloud resource configurations) for in-depth analysis. 

• Implement Cloud-Native Containment: Oversee the use of cloud-native automation to execute decisive containment actions across compromised environments, including sensitive data platforms. 

• Proactive Threat Hunting: Conduct advanced host-based and cloud-native analysis (digital forensics, metadata analysis) to proactively uncover Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs). 

• Strategic Collaboration: Engage with application, infrastructure, and business stakeholders to identify key information sources and influence security architecture decisions. 

• Meticulous Documentation: Ensure detailed and actionable documentation for every incident, capturing the Who, What, When, Where, Why, and How to drive continuous improvement. 

• Threat Modeling: Actively participate in threat modeling exercises for new services and capabilities, including purple team, tabletop, and CTF exercises.