97 Things Every Information Security Professional Should Know

Chapter 71. Security Incident Response and Career Longevity

Priscilla Li

A Security Incident Response Team (SIRT) plays a critical role in a company. This is a team of professionals responsible for preventing, detecting, and responding to security incidents. Most incident response teams are made up of the following roles:

Triage analyst

Evaluate incoming alerts, identify suspicious activities, and determine a disposition for each alert. Identify areas of opportunity for areas of automated response.

Detection engineer

Build and write detection alerts relevant to your environment. Perform threat hunting with the telemetry available in your environment. Respond to high-priority security incidents.

With increasing security threats and breaches, a SIRT has a major responsibility when a security incident happens. Incident responders often have to work under pressure to assess and respond to threats through intrusion detection, security auditing, and risk analysis. In order to experience career longevity in this line of work, here are three tips on how to combat burnout:

Teamwork

Recognize that managing security incidents is TEAMwork. The responsibility does not fall solely on the incident responder or manager. Incident response teams are critical. These teams typically include an Incident Commander, a Lead Incident Responder, and a Communication Lead. The role of the Incident Responder ...