The Cybersecurity Investigations & Response (CIR) team within AC3 (Aon’s Global Cybersecurity Operations) is responsible for leading and coordinating incident response, conducting in‑depth investigations, and continuously improving how Aon detects, responds to, and recovers from cyber events.
As a Cybersecurity Investigations & Response Lead, you will play a critical role in investigating and responding to security incidents across Aon’s North America region. You will work closely with Threat Detection & Response (TDR), Global Security Operations, IT, Legal, Risk, Audit, and business stakeholders to ensure incidents are handled effectively and consistently.
This role focuses on deep investigation, coordination, and response leadership—ensuring incidents are executed according to defined processes, evidence is preserved, risks are clearly understood, and lessons learned drive measurable improvements across Aon’s cybersecurity program.
Aon is in the business of better decisions:
At Aon, we shape decisions for the better to protect and enrich the lives of people around the world. As an organization, we are united through trust as one inclusive, diverse team, and we are passionate about helping our colleagues and clients succeed.
responsibilities :
Incident Response & Investigations
Lead or support end-to-end investigations for security incidents, from initial triage through containment, eradication, and recovery.
Perform detailed analysis of alerts, logs, and telemetry across multiple domains (SIEM, endpoint, identity, network, cloud, email, and third-party sources) to determine scope, root cause, and business impact.
Partner closely with AC3 Threat Detection & Response (TDR) teams to validate true positives, refine investigative hypotheses, and improve the quality and reliability of detection signals.
Develop clear incident timelines, findings, and technical assessments, ensuring accurate and complete case documentation.
Maintain high-quality incident records and evidence within Aon’s case management and response tooling.
Crisis & Stakeholder Coordination
Support crisis execution during major or high-severity incidents, collaborating with GEOC, Legal, Risk, Audit, Communications, and business leadership as required.
Translate technical findings into clear, risk-based insights for both technical and non-technical audiences.
Follow and reinforce consistent escalation and communication patterns—ensuring the right stakeholders are informed at the right time with the right level of detail.
Contribute to calm, structured, and disciplined response execution during high-pressure events.
Playbooks, Procedures & Readiness
Help develop, maintain, and improve incident response runbooks, playbooks, and standard operating procedures for common and high-impact scenarios (e.g., ransomware, BEC, insider threat, data exfiltration, cloud compromise).
Participate in, and help design, tabletop exercises and simulations to test technical response and crisis readiness.
Support audit, regulatory, and internal assurance activities by clearly documenting response processes, decisions, and evidence of execution.
Continuous Improvement & Threat Informed Defense
Lead or contribute to lessons learned activities following incidents and near misses; track improvement actions through to completion.
Partner with vulnerability management, identity, infrastructure, cloud, and application security teams to ensure investigation insights drive real risk reduction.
Identify detection and visibility gaps and work with TDR to enhance telemetry, tune detections, and improve signal-to-noise ratios across AC3.
Strengthen Aon’s threat informed defense by feeding investigative insights back into controls, detections, and processes.
Collaboration & Global Alignment
Operate within a follow the sun global model, coordinating with CIR and TDR peers across North America, EMEA, and APAC.
Support alignment of tools, telemetry, processes, and reporting across regions to enable consistent, scalable operations.
Contribute to a culture of collaboration, shared ownership, and continuous improvement across AC3 and Global Cybersecurity Solutions.
requirements-expected :
Professional experience in cybersecurity operations, incident response, digital forensics, threat hunting, or a closely related discipline.
Strong understanding of core security domains, including: Network security; Endpoint security; Identity and access management; Cloud security fundamentals; Common attack techniques (MITRE ATT&CK familiarity preferred)
Hands-on experience with multiple security technologies, such as: SIEM platforms (log analysis, investigation, correlation); EDR/EPP tools; Network security tools (firewalls, proxies, IDS/IPS); Email security and identity platforms; Cloud security and logging solutions
Demonstrated ability to analyze telemetry, develop investigative hypotheses, and methodically work incidents through to resolution.
Strong written and verbal communication skills, including the ability to produce clear technical documentation and concise executive-level summaries.
Familiarity with structured incident response frameworks (e.g., NIST, SANS, ISO) is preferred.
