Senior CERT Analyst (Cyber Incident Response)

About the role

Michelin's global CERT (Computer Emergency Response Team) supports facilities worldwide 24x7, with analysts in Europe, Asia and the Americas. The team focuses on three incident response missions: assessing impact, coordinating containment and remediation, and reducing risk to an acceptable level. This Senior CERT Analyst position is based at the headquarters in Greenville, SC, and involves advising other incident analysts and leading complex incident response scenarios.

Key responsibilities

• Prevent: stay up to date on threats and security technologies, assess and contextualize risk, and share findings with technical partners and the global CERT network.
• Detect: triage alerts, determine severity, and mentor during high-severity events; take part in shared on-call coverage including weekends and holidays.
• Lead business-as-usual and complex incidents (intrusions, malware, ransomware) from start to finish, coordinating containment, eradication and recovery across global teams.
• Cover global security incidents from 10 am to 7 pm EST/EDT on weekdays; weekend and holiday coverage is shared globally, and 24/7 availability is required only for critical events.

Required profile

• Minimum 5 years of incident response experience (CERT/SOC/CSIRT, manager, technical lead or forensics analyst).
• Education: at least a 2-year technical degree with 5+ years of information security experience, or a bachelor's degree in Computer Science, Cybersecurity, Information Technology or Computer Engineering.
• Clear written and verbal English, including executive-ready updates; strong documentation habits.
• Ability to mentor junior analysts and work across time zones; travel within North America and globally may be required but is infrequent.
• No immigration sponsorship available.

Required skills

• Knowledge of the cyber kill chain and MITRE ATT&CK for investigation and reporting.
• Network forensics and malware identification and eradication.
• Analyzing data from SIEM/EDR, network traffic, IDS/IPS, firewall and system logs, and OSINT.
• Windows/Linux administration or DevOps (2-3 years), networking concepts, protocols, architecture and hardening.
• Plus: Splunk, Python, PowerShell, database query languages or similar offensive/defensive security tools.

What we offer

• Personalized development plans, mentorship and cross-functional opportunities.
• Inclusive culture and option to join a Connected Community.
• Projects spanning sustainable materials to digital transformation.