Security Engineer

Overview

The Security Engineer (Incident Response) supports the triage, investigation, and remediation of security incidents to protect the corporate IT environment and maintain compliance with internal and external requirements.

What you'll do

• Respond to day-to-day alerts that come into security tooling including SIEM, EDR, email security, and other tooling.
• Independently work medium severity security investigations from detection to investigation to resolution.
• Participate in and contribute to team-based large-scale investigations.
• Perform forensic review of alerts, files, systems.
• Correlate multiple data points into a coherent story.
• Accurately determine true positive vs false positive with documented justification.
• Identify and communicate scope and impact of incidents.
• Document findings clearly and completely, communicate status and risk effectively.
• Perform consistent and accurate triage and analysis with a low error rate.
• Provide improvements to playbooks, runbooks, and detection rules, participate in tabletop exercises.
• Assist with driving incidents to full remediation and assist with implementing new and compensating controls.
• Configure, maintain, and monitor assigned tooling.
• Flag and remediate gaps in detection or process.
• Communicate incident findings in both technical and non-technical language to various teams.

What you'll need

• Bachelor's degree in Information Technology, Computer Science, a related field, or equivalent experience.
• 3+ years of experience in incident response and/or security operations center operations, triaging and investigating cyber events and incidents.
• 3+ years of experience managing security controls, including defining policies and administering EDR, email security, SIEM, performing detection engineering, and responding to alerts and incidents.
• 2+ years of experience creating incident response playbooks, runbooks, and tabletop exercises.
• 1+ years of experience as a security specialist in a regulated IT environment involving SOC2, SOX, HIPAA, GLBA, PCI, or a combination of these frameworks, including responsibility for assisting with or coordinating audits.
• 2+ years of experience in network and application security administration, penetration testing, and/or threat assessments.
• 5 years of experience in information technology or a related field within the last 10 years.
• 1+ years of generative AI and automation experience including scripting.
• Ability to participate in on-call rotation.

Details

• Nationwide remote position.
• Operates in a professional office environment.
• Applicants must be authorized to work for any employer in the U.S.; visa sponsorship, including CPT/OPT, is not available.
• Base salary range $105,700.00 - $149,275.00; non-sales positions may participate in a bonus program.
• Remote and hybrid positions require reliable high-speed wired internet from fiber, cable or DSL and a dedicated home work space with limited disruption.