Principal Engineer - Cybersecurity Incident Response

About the role

The pay range is $168,000.00 - $303,000.00. Pay is based on several factors which vary based on position. These include labor markets and in some instances may include education, work experience and certifications. In addition to your pay, Target cares about and invests in you as a team member, so that you can take care of yourself and your family.

Responsibilities

• Set and communicate the technical vision, architecture, and roadmap for incident response engineering, aligning security operations needs with Target's business and technical environments.
• Architect and lead the development of secure, reliable services, integrations, and automations using Python, APIs, event-driven patterns, and cloud-native technologies to accelerate triage, enrichment, evidence collection, analysis, containment, and recovery.
• Establish and drive engineering standards for source control, peer review, automated testing, CI/CD, release management, observability, documentation, secrets management, access controls, and resilient operations.
• Lead the design, development, and lifecycle management of security operations (SecOps) and security orchestration, automation, and response (SOAR) capabilities, including production-grade playbooks, integrations, case-management workflows, data enrichment, and analyst-facing tools.
• Provide hands-on, principal analyst-level incident commander support by leading complex or high-severity cyber investigations. Guide triage, hypothesis development, data collection, scoping, evidence analysis, timeline reconstruction, containment decisions, eradication, recovery, and clear documentation of findings and risk.
• Partner with incident responders, threat hunters, detection engineers, digital forensics, threat intelligence, Enterprise Architecture, and technology teams to convert investigative requirements and post-incident findings into scalable capabilities.
• Audit the viability, applicability, security, maintainability, and cost implications of technical solutions through proofs of concept, prototypes, architecture reviews, vendor evaluations, and build-versus-buy decisions.
• Define metrics and feedback loops that measure automation quality, platform reliability, investigative cycle time, analyst experience, and operational outcomes; use the results to drive continuous improvement.
• Work with engineering and cybersecurity leaders to build a high-performing team, provide technical leadership and coaching, mentor engineers and analysts, and participate in the selection and development of technical talent.
• Architect, engineer, and operationalize scalable live-response and forensic artifact collection solutions that enable secure, reliable acquisition of volatile and persistent evidence across endpoint, cloud, identity, network, and container environments, with built-in automation, evidence-integrity controls, observability, and integrations with investigative and SOAR workflows.
• Design, develop, and operationalize agentic AI-powered analysis tooling that integrates with SecOps, SIEM, SOAR, and case-management platforms to correlate telemetry and forensic evidence, automate repetitive investigative tasks, generate defensible findings, and recommend next investigative actions with appropriate human oversight and security controls.

Requirements

• 4-year degree or equivalent experience.
• Continuing education to maintain thorough knowledge of technical and cybersecurity domains while staying current with relevant technologies and threats.
• 10+ years of experience in technology development, cybersecurity engineering, security operations, or related services.
• 10+ years of hands-on cybersecurity incident response experience, including demonstrated ability to independently lead and support active enterprise investigations.
• Advanced Python programming and software engineering skills, including APIs, data structures, testing, code review, source control, packaging, error handling, and maintainable documentation.
• Demonstrated experience designing and operating automation through modern CI/CD and DevSecOps practices, including automated testing, secure deployment, monitoring, rollback, and change governance.
• Strong hands-on experience with SOAR platforms (SecOps preferred) and the development of production-grade playbooks, integrations, and workflows.
• Familiarity with adjacent technologies such as SIEM, EDR, case management, threat intelligence, identity, cloud security, and malware triage.
• Deep knowledge of the incident response lifecycle and the ability to analyze endpoint, network, identity, cloud, and file-based evidence; scope impact; build defensible timelines; and advise on containment, eradication, and recovery.
• Strong understanding of secure systems design and operations, including authentication and authorization, secrets management, logging and telemetry, data handling, evidence integrity, resilience, and failure recovery.
• Experience with REST APIs, SQL/NoSQL data stores, Git, PowerShell or Bash, containers/Kubernetes, and cloud technologies.
• Understands business fundamentals and how technology can support business goals, translate business and cyber risk into technical strategy, and evaluate financial and operational implications.
• Proven leadership capabilities, influence, interpersonal skills, sound judgment, and calm decision-making in time-sensitive situations.
• Excellent verbal, written, and presentation skills to communicate complex technical and investigative findings clearly to technical teams, cybersecurity leaders, and business stakeholders.
• Strong team player with excellent planning and organizational skills and a demonstrated commitment to teamwork and team effectiveness.

Qualifications

• 4-year degree or equivalent experience.
• Continuing education to maintain thorough knowledge of technical and cybersecurity domains while staying current with relevant technologies and threats.
• 10+ years of experience in technology development, cybersecurity engineering, security operations, or related services.
• 10+ years of hands-on cybersecurity incident response experience, including demonstrated ability to independently lead and support active enterprise investigations.
• Advanced Python programming and software engineering skills, including APIs, data structures, testing, code review, source control, packaging, error handling, and maintainable documentation.
• Demonstrated experience designing and operating automation through modern CI/CD and DevSecOps practices, including automated testing, secure deployment, monitoring, rollback, and change governance.
• Strong hands-on experience with SOAR platforms (SecOps preferred) and the development of production-grade playbooks, integrations, and workflows.
• Familiarity with adjacent technologies such as SIEM, EDR, case management, threat intelligence, identity, cloud security, and malware triage.
• Deep knowledge of the incident response lifecycle and the ability to analyze endpoint, network, identity, cloud, and file-based evidence; scope impact; build defensible timelines; and advise on containment, eradication, and recovery.
• Strong understanding of secure systems design and operations, including authentication and authorization, secrets management, logging and telemetry, data handling, evidence integrity, resilience, and failure recovery.
• Experience with REST APIs, SQL/NoSQL data stores, Git, PowerShell or Bash, containers/Kubernetes, and cloud technologies.
• Understands business fundamentals and how technology can support business goals, translate business and cyber risk into technical strategy, and evaluate financial and operational implications.
• Proven leadership capabilities, influence, interpersonal skills, sound judgment, and calm decision-making in time-sensitive situations.
• Excellent verbal, written, and presentation skills to communicate complex technical and investigative findings clearly to technical teams, cybersecurity leaders, and business stakeholders.
• Strong team player with excellent planning and organizational skills and a demonstrated commitment to teamwork and team effectiveness.

Skills

• Python programming and software engineering skills.
• Advanced Python programming and software engineering skills, including APIs, data structures, testing, code review, source control, packaging, error handling, and maintainable documentation.
• Hands-on experience with SOAR platforms (SecOps preferred).
• Familiarity with adjacent technologies such as SIEM, EDR, case management, threat intelligence, identity, cloud security, and malware triage.
• Deep knowledge of the incident response lifecycle and the ability to analyze endpoint, network, identity, cloud, and file-based evidence; scope impact; build defensible timelines; and advise on containment, eradication, and recovery.
• Strong understanding of secure systems design and operations, including authentication and authorization, secrets management, logging and telemetry, data handling, evidence integrity, resilience, and failure recovery.
• Experience with REST APIs, SQL/NoSQL data stores, Git, PowerShell or Bash, containers/Kubernetes, and cloud technologies.
• Understanding of business fundamentals and how technology can support business goals, translate business and cyber risk into technical strategy, and evaluate financial and operational implications.
• Leadership capabilities, influence, interpersonal skills, sound judgment, and calm decision-making in time-sensitive situations.
• Excellent verbal, written, and presentation skills to communicate complex technical and investigative findings clearly to technical teams, cybersecurity leaders, and business stakeholders.
• Strong team player with excellent planning and organizational skills and a demonstrated commitment to teamwork and team effectiveness.

Benefits

• Comprehensive health benefits and programs, including medical, vision, dental, life insurance, and more.
• 401(k), employee discount, short term disability, long term disability, paid sick leave, paid national holidays, and paid vacation.
• Competitive benefits from financial and education to well-being and beyond.

Pay

The pay range is $168,000.00 - $303,000.00. Pay is based on several factors which vary based on position. These include labor markets and in some instances may include education, work experience and certifications. In addition to your pay, Target cares about and invests in you as a team member, so that you can take care of yourself and your family.

Schedule

This role operates as a Hybrid/Flex for Your Day work arrangement based on Target’s needs. A Hybrid/Flex for Your Day work arrangement means the team member’s core role will need to be performed both onsite at the Target HQ MN location the role is assigned to and virtually, depending upon what your role, team and tasks require for that day. Work duties cannot be performed outside of the country of the primary work location, unless otherwise prescribed by Target.