IT - Incident Response Engineer

Job Summary

The IT - Incident Response Engineer role is responsible for identifying, analyzing, and responding to advanced cyber threats and incidents across Eaton's global enterprise, including cloud-native and hybrid environments. The role involves serving as a force-multiplier within the Prevent–Detect–Respond strategy, applying deep incident response and cloud security expertise.

Job Responsibilities

• Provide 24/7/365 cyber security incident response, focusing on responding to, containing, remediating, and recovering from cyber incidents across the global enterprise, including cloud-native and hybrid environments.
• Manage and coordinate response to malicious cyber activity inside or targeting Eaton's assets, including IT, cloud, and operational technology (OT) environments.
• Perform proactive threat hunting based on emerging indicators of compromise, vulnerabilities, and threat intelligence.
• Lead detection, investigation, and response for cloud security incidents across major platforms (Microsoft Azure, AWS, and/or Google Cloud), including identity, workload, container, and SaaS compromise scenarios.
• Develop and tune cloud-native detections using cloud logging and telemetry.
• Partner with cloud platform and engineering teams to embed security into cloud architecture and support Cloud Security Posture Management (CSPM) and workload protection initiatives.
• Track threat actors and campaigns relevant to Eaton's industry and geography; enrich incidents with contextual intelligence to drive faster, higher-confidence decisions.
• Design, build, and enable agentic AI and automation workflows (SOAR, scripting, AI agents) to accelerate triage, investigation, containment, and reporting across cloud and on-premises estates.
• Contribute to securing Eaton's adoption of AI — assessing AI/LLM systems and agents for security risk, and supporting evaluation of AI-enabled SOC and managed services capabilities.
• Conduct digital forensic analysis and eDiscovery in support of incident response, internal investigations, and legal/compliance requests, preserving evidence to investigative and chain-of-custody standards across endpoint and cloud sources.
• Provide security engineering services, including deployment, configuration, management, and updating of the security tool stack across cloud and on-premises.
• Develop advanced queries, correlation rules, and detections to enhance the organization's detection coverage and security posture.
• Contribute to SIEM architecture — including cloud log onboarding, normalization, content lifecycle, and tuning to focus detection operations and reduce false positives.

Qualifications

• Bachelor’s Degree from an accredited institution
• Minimum seven (7) years in security operations, incident response, cloud security, e-Discovery, insider threat, security engineering or related field
• No relocation is offered for this position. All candidates must currently reside within 50 miles of Beachwood, OH.
• Demonstrated hands-on experience leading or performing cyber security incident response, including containment, remediation, and recovery
• Hands-on cloud security experience with one or more major platforms
• Experience correlating events from multiple sources — including cloud-native sources — to detect suspicious and/or malicious activity
• Detection engineering experience and SIEM content development and architecture
• Experience building automation and/or agentic AI workflows (SOAR, scripting in Python/PowerShell, AI agents) to streamline security operations
• Working knowledge of AI/LLM security concepts and the risks associated with enterprise AI adoption
• Solid understanding of adversary TTPs and the MITRE ATT&CK framework
• Capacity to comprehend complex technical infrastructure, managed services, and third-party dependencies
• Strong analytical and problem-solving skills