Enterprise Insider Threat

CSIRT L3 – Key Points

Role

• Senior/lead incident responder, escalation point above L1/L2
• Leads high-severity (P1/P2) incident response end-to-end

Core Responsibilities

• Advanced forensic analysis (disk, memory, network, cloud)
• Root cause analysis, attack timeline reconstruction, MITRE Telecommunication&CK mapping
• Basic malware/artifact analysis or coordination with malware team
• Proactive threat hunting using threat Client/IOCs
• Detection engineering – tune SIEM/EDR/NDR rules
• Act as Incident Commander on major incident bridges
• Mentor/train L1 & L2 analysts; review their escalations
• Own playbooks, runbooks, SOPs
• Coordinate with legal, compliance, PR, leadership during incidents
• Support breach notification/regulatory reporting (GDPR, CERT-In, PCI-DSS)
• Drive post-incident reviews (RCA), track remediation
• Present metrics/summaries to leadership
• Contribute to tabletop exercises, purple teaming, SOAR automation

Experience

• 6–10+ years in cybersecurity; 3+ years in IR/SOC L2-L3
• Cloud IR experience (AWS/Azure/GCP) a plus