Senior Cyber Security Engineer

Job Description

Global retailer is looking for a Senior Cyber Security Engineer for their NYC headquarters. This position is hybrid.

We are looking for a Senior SOC Engineer, within the Cyber Incident Response team to be an L2: This is a professional responsible for protecting computer systems, networks, and sensitive data from cyber-attacks, hacking attempts, and other security threats with past experience working in a SOC.

The role collaborates with other security and IT teams, leveraging available technology and systems to provide Incident Response services. In addition, the role contributes to other activities, such as participating in Group projects and initiatives with implications on IR services.

Responsibilities

\n
• Investigate and respond to cybersecurity incidents in real-time, including handling more complex and high-severity cases.
\n
• Work with a team of analysts to determine the scope, root cause, attack techniques, and impact of attacks.
\n
• Perform detailed analysis across endpoint, network, identity, and cloud data sources, including log analysis, process activity, and authentication events.
\n
• Support basic forensic investigations, including evidence collection, timeline reconstruction, and analysis of suspicious files or activities.
\n
• Develop, implement, and maintain incident response plans, playbooks, and SOPs to contain and mitigate cybersecurity incidents.
\n
• Develop and enhance incident detections and triggers, aligned with the evolving threat landscape and leveraging available technology (e.g., SIEM correlation, EDR detections).
\n
• Operate with various systems in real-time to investigate, maintain, and track incidents across their lifecycle.
\n
• Perform deeper analysis and correlation across multiple data sources to identify threats and potential lateral movement.
\n
• Collaborate with other teams, including IT, security risk, forensics, and legal, to ensure a coordinated response to incidents.
\n
• Communicate security incidents, findings, and recommendations to management, stakeholders, and relevant parties.
\n

Qualifications

\n
• Strong knowledge of networking, systems, identity, and cloud environments, including investigation and troubleshooting.
\n
• Strong understanding of cybersecurity principles, including threat intelligence, incident response, forensics, vulnerability management, and cyber awareness.
\n
• Practical experience in log analysis, endpoint investigation, and understanding attacker techniques (e.g., lateral movement, persistence, privilege escalation).
\n
• Experience with security tools such as SOAR, SIEM, IDS/IPS, EDR, mail gateway, and other relevant technologies.
\n
• Ability to handle complex incidents in a fast-paced environment and manage multiple tasks simultaneously.
\n
• Excellent proficiency in English. Fluency in additional languages is a strong asset.
\n
• Industry-recognized security certifications, including but not limited to: CISSP, CEH, CISA, GSEC, GCIA, GCIH, GCFA, GCFE, GPEN, GWAPT, GMOB, GREM, GASF, GCTI or equivalent certifications, are a strong asset.
\n