Incident Response Engagement-Lead

Cowbell Cyber Inc. | Cyber insurance

1d 9h ago

Remote In-Country

Full Time

United States of America

Title: Incident Response Engagement-Lead Location: United States (Remote)

Cowbell is signalling a new era in cyber insurance by harnessing technology and data to provide small and medium-sized enterprises (SMEs) with advanced warning of cyber risk exposures bundled with cyber insurance coverage adaptable to the threats of today and tomorrow. Championing adaptive insurance, Cowbell follows policyholders’ cyber risk exposures as they evolve through continuous risk assessment and continuous underwriting. In its unique AI-based approach to risk selection and pricing, Cowbell’s underwriting platform, powered by Cowbell Factors, compresses the insurance process from submission to issue to less than 5 minutes.

Founded in 2019 and based in the San Francisco Bay Area, Cowbell has rapidly grown, now operating across the U.S., Canada, U.K., and India. This growth was recently bolstered by a successful Series C fundraising round of $60 million from Zurich Insurance. This investment not only underscores the confidence in Cowbell’s mission but also accelerates our capacity to revolutionize cyber insurance on a global scale. With the backing of over 25 prominent reinsurance partners, Cowbell is poised to redefine how SMEs navigate the evolving landscape of cyber threats.

Position Overview

Cowbell is seeking an experienced Incident Response Case-Lead to join our growing Resiliency Services. In this role, you will serve as a critical liaison among Cowbell’s Claims Team, breach counsel, Incident Response providers, and affected policyholders — guiding organizations through the full lifecycle of a cyber incident with technical depth, legal awareness, and clear communication. You will bring a specialized blend of hands-on forensic expertise, project management discipline, and the consulting acumen required to translate complex findings for diverse stakeholders under high-pressure conditions.

Key Responsibilities

Lead and manage all phases of the incident response lifecycle — including scoping, containment, eradication, and recovery — across moderately complex, multi-system environments.
Serve as the primary point of contact for Cowbell Claims Team, breach counsel, Incident Response providers, and policyholders throughout active engagements.
Oversee the work of digital forensics and incident response providers, ensuring timely and accurate analysis of affected systems and environments.
Identify and actively manage scope creep across concurrent engagements, maintaining project timelines and stakeholder alignment.
Schedule, organize, and moderate the briefing of complex forensic findings into clear, actionable reporting tailored to technical, legal, and executive audiences.
Operate with an understanding of Attorney-Client Privilege and Work Product Doctrine, ensuring appropriate handling of sensitive investigation materials in coordination with legal counsel.
Collaborate cross-functionally with claims adjusters, underwriters, and external partners to support accurate incident documentation and coverage determinations.
Contribute to the continuous improvement of Cowbell Resiliency Service’s incident response methodologies, playbooks, and tooling.

Required Qualifications

Experience

4–6 years of hands-on DFIR experience, with meaningful exposure to the cyber insurance ecosystem — including work with or on behalf of insurance carriers, breach counsel, and/or policyholders.
Demonstrated experience managing the scoping, containment, eradication, and recovery phases of cyber incidents.
Proven track record leading moderately complex, multi-system incident investigations, with strong project management skills and an ability to identify and control scope creep.
Ability to operate effectively within legally sensitive environments, including an understanding of Attorney-Client Privilege and the Work Product Doctrine.
Strong consulting and communication skills, with experience presenting forensic findings to mixed audiences including legal, technical, and executive stakeholders.

Education & Certifications

A bachelor’s degree in Cybersecurity, Information Security Management, Digital Forensics, Computer Science, or a related field is preferred. In lieu of a degree, equivalent professional experience combined with one or more of the following industry certifications will be considered:

GIAC Certified Incident Handler (GCIH)
GIAC Network Forensic Analyst (GNFA)
CompTIA Cybersecurity Analyst (CySA+)
Certified Information Security Manager (CISM)
Certified Information Systems Security Professional (CISSP)

Equal Employment Opportunity:

We are committed to equal opportunity in the terms and conditions of employment for all employees and job applicants without regard to race, color, religion, sex, sexual orientation, age, gender identity or gender expression, national origin, disability, or veteran status.

Cowbell is a leading innovator in cyber insurance, dedicated to empowering businesses to always deliver their intended outcomes as the cyber threat landscape evolves. Guided by our core values of TRUE—Transparency, Resiliency, Urgency, and Empowerment—we are on a mission to be the gold standard for businesses to understand, manage, and transfer cyber risk.

At Cowbell, we foster a collaborative and dynamic work environment where every employee is empowered to contribute and grow. We pride ourselves on our commitment to transparency and resilience, ensuring that we not only meet but exceed industry standards.

We are proud to be an equal opportunity employer, promoting a diverse and inclusive workplace where all voices are heard and valued. Our employees enjoy competitive compensation, comprehensive benefits, and continuous opportunities for professional development.

Cowbell is an E-Verify employer. E-Verify is a web-based system that allows an employer to determine an employee's eligibility to work in the US using information reported on an employee's Form I-9. The E-Verify system confirms eligibility with both the Social Security Administration (SSA) and Department of Homeland Security (DHS). For more information, please go to the USCIS E-Verify website.

For more information, please visit .

Cowbell Cyber does not permit the use of AI tools during any stage of our interview process. By submitting your application, you agree to complete all assessments and interviews without the use of generative AI assistance.

Required Languages

🇬🇧 English

Position Overview

Key Responsibilities

Lead and manage all phases of the incident response lifecycle — including scoping, containment, eradication, and recovery — across moderately complex, multi-system environments.

Serve as the primary point of contact for Cowbell Claims Team, breach counsel, Incident Response providers, and policyholders throughout active engagements.

Oversee the work of digital forensics and incident response providers, ensuring timely and accurate analysis of affected systems and environments.

Identify and actively manage scope creep across concurrent engagements, maintaining project timelines and stakeholder alignment.

Schedule, organize, and moderate the briefing of complex forensic findings into clear, actionable reporting tailored to technical, legal, and executive audiences.

Operate with an understanding of Attorney-Client Privilege and Work Product Doctrine, ensuring appropriate handling of sensitive investigation materials in coordination with legal counsel.

Collaborate cross-functionally with claims adjusters, underwriters, and external partners to support accurate incident documentation and coverage determinations.

Contribute to the continuous improvement of Cowbell Resiliency Service’s incident response methodologies, playbooks, and tooling.

Required Qualifications

Experience

4–6 years of hands-on DFIR experience, with meaningful exposure to the cyber insurance ecosystem — including work with or on behalf of insurance carriers, breach counsel, and/or policyholders.

Demonstrated experience managing the scoping, containment, eradication, and recovery phases of cyber incidents.

Proven track record leading moderately complex, multi-system incident investigations, with strong project management skills and an ability to identify and control scope creep.

Ability to operate effectively within legally sensitive environments, including an understanding of Attorney-Client Privilege and the Work Product Doctrine.

Strong consulting and communication skills, with experience presenting forensic findings to mixed audiences including legal, technical, and executive stakeholders.

Education & Certifications

GIAC Certified Incident Handler (GCIH)

GIAC Network Forensic Analyst (GNFA)

CompTIA Cybersecurity Analyst (CySA+)

Certified Information Security Manager (CISM)

Certified Information Systems Security Professional (CISSP)

Equal Employment Opportunity:

For more information, please visit .