At Stoke, we believe a thriving space economy will enable a vibrant, sustainable, and equitable future here on Earth. That is why we’re building Nova, our fully and rapidly reusable launch vehicle. Designed for daily flight, Nova tackles the core challenges of space transportation by reducing cost, increasing availability, and improving reliability. By radically lowering launch costs and increasing flight cadence, we’re helping create a truly scalable space industry.

Our team is mission-driven, collaborative, and empowered to take ownership of their work. If you want to work alongside some of the most dedicated and talented people on Earth, we’d love to have you join us.

Description

Reusable launch systems depend on secure, resilient information systems. As a Cybersecurity Incident Response Lead, you will lead the detection, investigation, containment, and recovery of cybersecurity incidents affecting Stoke’s infrastructure, engineering environments, manufacturing systems, and sensitive aerospace data.

This is a hands-on technical leadership role with ownership of incident response readiness and execution. You will lead complex investigations, coordinate response across teams, and translate findings into practical improvements that reduce risk and strengthen our ability to respond. You will provide technical direction and mentorship while working closely with IT, security, software engineering, manufacturing, and operations.

We are a small, highly motivated team. You will balance decisive response with operational safety and continuity, keeping technical teams and leadership informed as incidents evolve. You must be ready to stay focused, move fast, self-direct, and learn on the fly.

Responsibilities

Lead cybersecurity incidents from initial triage through containment, eradication, recovery, and closure; establish severity, scope, response priorities, and escalation paths
Serve as the technical incident lead, coordinating responders, assigning actions, maintaining decision records, and escalating business risks and resource needs
Investigate endpoint, identity, network, cloud, and application activity to reconstruct timelines, identify initial access and persistence, and assess affected systems and data
Collect and preserve logs, forensic artifacts, and other evidence with documented handling, chain of custody, and appropriate access controls
Coordinate containment and recovery with system owners, validating remediation and monitoring for recurrence; align actions affecting manufacturing, test, or launch systems with operational and safety requirements
Maintain the incident response plan, escalation procedures, and playbooks for scenarios such as compromised accounts, ransomware, data exfiltration, and cloud compromise
Improve detection coverage and response workflows using SIEM, endpoint detection and response, threat intelligence, and automation; identify telemetry gaps and tune alerts
Conduct threat hunting and translate investigation findings into detection rules, control improvements, and prioritized remediation with accountable owners
Provide clear incident updates and reports that distinguish confirmed findings from uncertainty and explain business impact, response actions, and outstanding risks
Coordinate with leadership, legal, compliance, and external response partners to support evidence requests and applicable notification obligations
Lead tabletop exercises and post-incident reviews; track corrective actions and measure response effectiveness, readiness, and recurring failure patterns
Mentor responders, maintain investigation standards, and participate in on-call coverage and after-hours response for critical incidents
Perform additional duties as assigned to support organizational goals and objectives

Qualifications

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent practical experience
5+ years of experience in cybersecurity operations, incident response, digital forensics, or a related technical field, including hands-on leadership of complex security incidents