Incident Response, Senior Associate

Huron is redefining what a global consulting organization can be. Advancing new ideas every day to build even stronger clients, individuals and communities. We’re helping our clients find new ways to drive growth, enhance business performance and sustain leadership in the markets they serve. And, we’re developing strategies and implementing solutions that enable the transformative change they need to own their future. As a member of the Huron corporate team, you’ll help to evolve our business model to stay ahead of market forces, industry trends and client needs. Our accounting, finance, human resources, IT, legal, marketing and facilities management professionals work collaboratively to support Huron’s collective strategies and enable real transformation to produce sustainable business results. Join our team and create your future. Huron's Corporate Information Security team directs the global enterprise information security program, coordinating security efforts across IT, GRC, HR, Legal, and the business units. As incident volume and technical complexity grow, an Incident Response Sr. Associate is needed to provide the hands-on investigative capability behind each incident: analyzing evidence, scoping compromise, driving containment, and establishing root cause, working alongside the Incident Response Manager and other stakeholders. Description This individual is responsible for the technical execution of incident response: deep-dive triage of escalated alerts, evidence collection and analysis across a complex technical environment, scoping the extent of compromise, and recommending and supporting containment and eradication. The role produces the technical findings and timelines that drive decisions during an incident and the root cause analysis that follows it, working closely with the Incident Response Manager, who owns stakeholder coordination and executive reporting. Scope is response-focused, with periodic collaboration with the broader information security team to feed incident findings into threat hunting, detection engineering, and other program maturation. The role requires dynamic coverage with flexibility to work outside standard business hours when an active incident requires it, and the work demands analytical rigor under time pressure, disciplined evidence handling, and clear technical writing. Key Responsibilities Technical triage and investigation ·       Perform deep-dive analysis of escalated alerts and suspected incidents across endpoint, identity, email, network, and cloud telemetry. ·       Reconstruct attacker and user activity into a defensible timeline establishing what happened, when, and what was affected. ·       Determine the scope of compromise, including affected accounts, systems, and data. ·       Establish root cause and distinguish confirmed findings from assumptions in every write-up. Containment, eradication, and recovery