Security Incident Response Engineer

Responsibilities

• Analyze and investigate threats and suspicious activity occurring on client devices.
• Develop requirements for detection models and improve existing detection systems.
• Collect, transform, and ingest raw data from disparate sources into threat detection pipelines.
• Streamline incident response capabilities and clarify related tooling and processes.
• Collaborate with security engineering and data science teams to analyze security event data at scale.
• Provide actionable insights to identify, prevent, detect, and respond to anomalous or malicious user and entity activity.
• Serve as a subject-matter expert and primary contact for Security Analytics, Detection, and broader security initiatives.
• Lead projects, mentor teammates, and champion quality standards.

Requirements

• At least 3 years of experience analyzing large datasets to solve problems and/or building behavior-based security models.
• Bachelor’s or master’s degree in Computer Science or a related field, or equivalent experience.
• Expert knowledge of Python and SQL, with familiarity with other programming languages.
• Experience with log analysis, network security, digital forensics, and incident response investigations.
• Proficiency developing and using analytical methods to build, automate, and improve detection and response systems.
• Ability to communicate results clearly and focus on impact.
• Preferred qualifications include an adversarial mindset, knowledge of threat actor goals and TTPs, and experience with tactical threat intelligence or threat hunting.
• Preferred experience includes software engineering, data processing and analysis tools, big data or data science frameworks, network observability, security software, data engineering solutions, UEBA, SIEM, SOAR, or DLP.