Incident Responder (CSIRT)

When to Use

• Declare and classify a security incident (scope, severity, data/asset impact)
• Reconstruct timelines from logs, EDR, cloud audit, identity, and application evidence
• Preserve forensic artifacts with chain of custody and legal hold awareness
• Coordinate containment, eradication, and recovery with engineering, cloud, and identity teams
• Draft stakeholder updates (internal, executive, customer, partner) on a cadence
• Prepare regulatory notification fact packs for legal/compliance (timelines, data categories, counts)
• Facilitate post-incident review, lessons learned, and tracked remediation

When NOT to Use

• Triage and close routine SOC alerts without declared incident → soc-analyst
• Proactive hypothesis-driven hunts and detection backlog from hunts → threat-hunter
• Design SEV matrices, on-call rotations, paging, or status-page programs → incident-management-engineer
• Define enterprise security strategy, policies, or GRC roadmaps → cybersecurity
• Implement SIEM/EDR connectors, IAM, or guardrails → information-security-engineer
• Harden cloud accounts or remediate CSPM findings (non-incident) → cloud-security-engineer
• Authorized penetration testing → penetration-tester
• Red team / adversary simulation campaign planning → red-team-specialist
• LLM/agent adversarial testing → ai-redteam
• Build audit evidence pipelines or control mapping → compliance-engineer
• Add CI/CD security gates or SBOM workflows → devsecops
• Lead reliability/SLO mitigation for availability outages → site-reliability-engineer
• Deep disk/memory artifact analysis, expert witness prep outlines → digital-forensics-analyst
• Disassembly, decompilation, patch diff, or dedicated malware RE lab work → reverse-engineer

Related skills

Core Workflows

1. Intake and declaration

1. Confirm trigger source (SOC escalation, employee report, vendor, law enforcement, customer)
2. Assign incident ID; open record and comms channel
3. Classify type (account compromise, malware, data breach, ransomware, supply chain, etc.)
4. Set severity from impact and urgency; document rationale
5. Notify incident commander, legal, and comms per severity matrix

See references/incidentdeclarationand_severity.md.

2. Scope and timeline

1. Identify affected users, systems, accounts, regions, and data classes
2. Establish first known compromise and detection timestamps (UTC)
3. Build parallel timeline: attacker actions, defender actions, business events
4. List evidence sources still available; flag gaps and retention risks
5. Update scope statement when new facts emerge (version each change)

See references/timelineandevidence_handling.md.

3. Containment → eradication → recovery

1. Contain to stop spread (isolate hosts, disable accounts, block IOCs, revoke tokens)
2. Eradicate root cause (remove malware, close backdoors, patch vulns, rotate secrets)
3. Recover with validation (rebuild from gold image, restore from clean backup, monitor for recurrence)
4. Time-box destructive actions; get approvers for customer-impacting steps
5. Hand off long-term hardening to owning engineering/security skills

See references/containmenteradicationrecovery.md.

4. Stakeholder and regulatory communications

1. Set update cadence by severity (e.g., 30–60 min for SEV1 security)
2. Separate facts from hypotheses in every update
3. Route external/customer/regulatory language through legal and comms
4. Prepare notification worksheets (what, when, who affected, measures taken)—legal decides if/when to notify

See references/stakeholderandregulatory_comms.md.

5. Post-incident review

1. Close incident only when containment verified and monitoring in place
2. Run blameless review within agreed SLA (e.g., 5 business days for major incidents)
3. Capture root cause classes, detection gaps, and prioritized actions with owners/dates
4. Feed lessons to detection (soc-analyst), controls (information-security-engineer), and program (incident-management-engineer)

See references/postincidentreview.md.

When to load references

• Role boundaries and handoffs → references/incidentresponderscope.md
• Declaration and severity → references/incidentdeclarationand_severity.md
• Timeline and evidence → references/timelineandevidence_handling.md
• Contain / eradicate / recover → references/containmenteradicationrecovery.md
• Comms and regulatory prep → references/stakeholderandregulatory_comms.md
• Post-incident review → references/postincidentreview.md

Outputs

• Incident record — ID, severity, scope, status, owners, key timestamps
• Timeline — UTC table of events with evidence pointers
• Evidence log — artifact, collector, hash, storage location, custody notes
• Action tracker — containment/eradication tasks with approvers
• Comms drafts — internal, executive, customer (facts-only sections)
• Regulatory prep pack — fact summary for legal (not legal advice)
• Post-incident review — findings, actions, detection/control improvements