Senior CERT Specialist

New York City Cyber Command is seeking a Senior Computer Emergency Response Team (CERT) Specialist to serve the City of New York as an advanced-level cybersecurity Digital Forensics and Incident Response (DFIR) practitioner. Reporting to the CERT Lead and serving as a senior technical authority above CERT Specialists, the Senior CERT Specialist guides the development, enhancement, and deployment of citywide incident response policies, procedures, and capabilities. This role is a primary technical escalation point for high-profile cybersecurity incidents impacting City agencies, particularly during identification, containment, and eradication phases, and provides technical mentorship to junior CERT Specialists.

Responsibilities will include:

• Serve as a senior technical escalation point for high-profile cybersecurity incidents, supporting the CERT Lead in ensuring 24x7 operational readiness;
• Lead complex incident response engagements end-to-end, coordinating activities among City departments, external partners, and state, federal, and private entities;
• Provide technical mentorship, peer review, and on-the-job training to CERT Specialists, including guidance on forensic methodology, analytical rigor, and report quality;
• Act as a subject matter expert in investigating cybersecurity incidents through advanced log, file, and malware analysis;
• Perform and oversee memory, network, disk, and cloud forensics across enterprise environments (AWS, Azure, GCP);
• Devise and validate remediation strategies and assist affected City agencies in containing, eradicating, and recovering from cybersecurity incidents;
• Lead the development of post-incident action plans and root-cause analyses to improve Mean Time to Detect, Respond, and Recover/Restore;
• Design, build, and enhance cyber-incident detection tools, automation, and response capabilities, including custom tooling and detection content;
• Partner with cyber threat intelligence teams to operationalize indicators, TTPs, and campaign intelligence into proactive countermeasures and threat hunts;
• Design, lead, and facilitate cyber tabletop exercises with City departments to identify capability gaps, procedural weaknesses, and critical infrastructure dependencies;
• Contribute to the development, review, and continuous improvement of citywide incident response policies, playbooks, and standard operating procedures;
• Assist NYC agencies in maturing their cyber incident response programs through direct consultation and capability assessments;
• Maintain current knowledge of cyber threat campaigns, adversary tradecraft, and emerging vulnerabilities, and share that knowledge across the team;
• Participate in on-call rotation, which may require rotational weekday/weekend coverage;
• Handle special projects and initiatives as assigned.

Hours/Shift: Day - Due to the necessary technical duties of this position in a 24/7 operation, candidate may be required to work various shifts such as weekends and/or nights/evenings.

Work Location: Brooklyn, NY