Senior Incident Response Analyst

Job description

At Zimmer Biomet, we believe in pushing the boundaries of innovation and driving our mission forward. As a global medical technology leader for nearly 100 years, a patient’s mobility is enhanced by a Zimmer Biomet product or technology every 8 seconds. As a Zimmer Biomet team member, you will share in our commitment to providing mobility and renewed life to people around the world. To support our talented team, we focus on development opportunities, robust employee resource groups (ERGs), a flexible working environment, location specific competitive total rewards, wellness incentives and a culture of recognition and performance awards.

We are committed to creating an environment where every team member feels inspired, invested, cared for, valued, and have a strong sense of belonging. What You Can Expect We’re seeking a Senior Incident Response Analyst to join our cybersecurity incident response team. This is a hands-on technical role responsible for investigating and responding to cybersecurity incidents in a global follow-the-sun operating model, including participation in on-call and major incident rotations.

How You'll Create Impact Lead complex, high-risk security incidents through the full response lifecycle—from detection and investigation through containment, eradication, recovery, root cause analysis, stakeholder communications, and post-incident reporting. Conduct advanced forensic analysis, threat hunting, and evidence collection across endpoint, network, identity, SaaS, and cloud environments. Drive post-incident reviews and translate lessons learned into detection improvements, security controls, operational processes, and prevention strategies.

Develop, maintain, and optimize SIEM and SOAR detections, automation workflows, integrations, log ingestion pipelines, and response playbooks. Analyze operational metrics, alert quality, and detection performance to prioritize tuning, automation, and threat detection improvements. Mentor and collaborate with other team members to improve the overall security program.

What Makes You Stand Out SIEM/SOAR

Experience investigating and improving detection/automation content. Set up integrations to facilitate log ingestion. Build custom parsers as needed.

EDR/XDR

Experience investigating endpoint threats and using endpoint telemetry for containment/remediation.

OS & Networking

Windows and Linux; TCP/IP, DNS (and related enterprise networking fundamentals).

Scripting/Automation

Proficiency with at least one (Python, PowerShell, Bash) to support analysis and workflow automation.

Cloud

Experience investigating cloud-native security incidents within Azure, AWS, or GCP, including identity, storage, compute, logging, and access control events. Your Background 5–8+ years of experience in an incident response or engineering role. Strong analytical and investigation skills with demonstrated ability to handle complex incidents. Ability to communicate clearly and produce concise, defensible incident documentation.

Advanced knowledge of Microsoft 365 security architecture, including SharePoint Online, email security, Conditional Access, Defender XDR, and identity threat detection and response, with the ability to lead complex cloud incident investigations.

Preferred

GCIH, GCFA, SIEM specific certifications (Pentest+, OSCP), Relevant Microsoft certs (SC-200, SC-300, SC-400, SC-500)

Nice to have

CISSP, CCSP, CEH, GSOC, GCIA, GCTI, Security, or equivalent. Work Model / Coverage Supports a global follow-the-sun incident response model. Participation in on-call and major incident rotations is required. Expected Compensation - $125,000-$145,000 base salary EOE