Incident Responder

BlackCloak’s mission is to protect corporate executives and high-profile individuals in their personal lives, mitigating risks to their families, companies, reputation, and finances. We defend our clients’ digital lives from hackers, privacy leaks, and identity theft. If you are passionate about helping to protect others, then keep reading - this may be your next great opportunity. 

BlackCloak is seeking a seasoned and highly skilled Senior Incident Responder to join our Technical Success Team. This is a senior, client-facing individual contributor role for someone who has spent years on both sides of the problem: the technical compromise of computers, phones, and online accounts, and the financial fraud that so often follows it. In this critical role, you will serve as the primary escalation point and lead investigator for complex security events; taking ownership of the full incident response lifecycle, from initial triage and containment through eradication, recovery, and post-incident reporting.

Our clients are executives, board members, and high-profile individuals whose personal accounts and devices are targeted precisely because their corporate ones are hard to breach. When something goes wrong in a client's personal digital life, you are the person who takes the call, works the incident end to end, and stays with them until it is resolved. You will also help us get better at preventing the next one: mapping how each incident unfolded against both the cyber attack kill chain and the personal attack kill chain, closing the gaps that made it possible, and mentoring the responders behind you.

If you excel at guiding clients through high-stress situations, possess deep technical expertise in digital forensics, and have a proven track record of handling sophisticated threats targeting high-profile individuals, this is an opportunity to elevate your career and make a tangible impact.

What You Will Do

• Execute End-to-End Incident Response: Lead comprehensive incident handling consistent with core IR principles (NIST/SANS) from the initial client request and triage through containment, recovery, and post-incident lessons learned.

• Investigate Complex Compromises & Targeted Attacks: Manage and remediate severe client security incidents, including but not limited to, compromised email ecosystems, SIM swap attacks, financial account takeovers, and targeted credential harvesting.

• Device Analysis: Conduct analysis on client computers and mobile devices to assess the scope of compromise and implement effective remediation strategies.

• Remediate Fraud & Identity Theft: Analyze and assess account activity and transaction records available to the client on their email, banking, retail, and social platforms to help establish what occurred, and support clients in their conversations with the platforms on fraud investigations, disputes, account freezes, etc.. Guide identity theft victims through the remediation process - credit bureau freezes and fraud alerts, IdentityTheft.gov and law enforcement reporting - and advise clients on the activity they should watch for and report back to the team.