Senior Incident Response Engineer

AI Summary

Job Description

Lead incident response efforts, acting as the primary technical liaison for the MSSP. Responsibilities include translating alerts into actionable responses, conducting forensic investigations, threat hunting, and developing detection rules. You will also design IR playbooks, manage endpoint detection policies, and contribute to the overall IR program strategy.

Hard Requirements

• 5+ years in Incident Response or Security Operations (SOC)
• Proven experience managing MSSP relationships, alert triage, and SLA performance
• Hands-on experience investigating security incidents (malware analysis, phishing, ransomware, insider threats)
• Deep understanding of OS internals (Windows/Mac/Linux) and network protocols
• Proficiency in scripting (Python, PowerShell, Bash) for automation
• Working knowledge of SIEM platforms (Google SecOps/Chronicle, Splunk, Microsoft Sentinel) and query languages
• Hands-on experience with SOAR platforms (Google SecOps/Chronicle, Palo Alto Cortex XSOAR, Splunk Phantom SOAR)
• Knowledge of Cyber Threat Intelligence standards and User Behavior Analytics (UEBA)
• Strong technical writing skills for security documentation
• Experience designing, leading, and facilitating tabletop exercises or incident simulations
• Experience conducting proactive threat hunts using SIEM and EDR telemetry
• Broad security utility across firewalls, network security, cloud security (AWS/Azure/GCP), and application security
• Excellent technical and executive writing and communication skills

Soft Requirements

• Familiarity with aerospace and startup environments
• Advanced malware analysis skills (static/dynamic) using IDA Pro, Ghidra, or Cuckoo Sandbox
• Familiarity administering email security platforms and conducting phishing campaigns
• Strong understanding of NIST SP 800-171 and CMMC Level 2 requirements related to Incident Response and Audit/Accountability