Ransomware Jobs in Michigan (NOW HIRING)

Lead and independently own security investigations from detection through containment, remediation, and root cause analysis.

Lead and participate in incident response activities, including high-severity and time-critical incidents.

Conduct proactive threat hunting to identify indicators of compromise before they escalate to incidents.

Perform in-depth malware and ransomware analysis to identify threat behaviors, techniques, and remediation paths.

Investigate security incidents using SIEM, EDR, MDR, and related tooling, and review logs to detect anomalies that may indicate a breach.

Document and conduct root cause analysis in support of investigations and produce clear written findings.

Deploy and implement security tools to protect company assets.

Serve as the point of contact for assigned security vendors responsible for managed services and handling escalations.

Act as a subject matter expert across endpoint security, EDR, MDR, firewall, email security, spam filtering, PAM, and vulnerability management.

Leverage automation to streamline workflows and increase operational efficiency.

Provide technical guidance and mentorship to junior team members.

Review, create, and document standard operating procedures.

Provide technical input to internal and external audits and implement operational security controls based on audit findings.

Adhere to all company policies and procedures, which include IATF, ISO, ISMS, QMS, TISAX, and safety-related policies.

5+ years of hands-on security operations experience, with deep, demonstrable technical ownership of incident response and active security investigations.

A Bachelor s degree in Computer Science or a related field is required.

Proven, hands-on experience leading complex security investigations and incident response end-to-end, including documenting and conducting root cause analysis.

Demonstrated experience designing and executing proactive threat hunting exercises.

Demonstrated hands-on experience investigating malware and ransomware incidents, including identifying threat behaviors, techniques, and remediation paths.

In-depth knowledge of TCP/IP networking and routing, with the ability to apply it to real incident analysis.

Hands-on operational proficiency with SIEM, EDR, IDS/IPS, firewall, email security, endpoint security, and vulnerability scanning tools, with the ability to use them to investigate and resolve incidents actively.

Familiarity with NIST CSF and other security controls and guidelines for incident response.

Ability to operate independently with minimal oversight and provide technical direction to less experienced team members.

Ability to coordinate with and gain the trust of business stakeholders and maintain third-party vendor relationships.

Able to work under pressure in critical circumstances.

Industry standard information security certifications (CISSP, GCIA, GCIH, GCFA, CASP+, Security+, Network+, or similar) are preferred.