Security Incident Response Engineer

Responsibilities

• Detect, analyze, and respond to security incidents detected by EDR, SIEM, and Cloud Security tooling as well as MDR service providers.
• Lead or participate in investigation and containment efforts for both endpoint and identity related security threats.
• Develop and implement strategies to remove the root cause of the incident.
• Conduct forensic data acquisition, log analysis, and root cause determination for endpoint incidents.
• Develop and maintain incident response playbooks and runbooks specific to EDR technologies.
• Analyze security alerts and anomalies to determine if they represent actual security incidents.

Requirements

• Proficiency with leading Endpoint Detection and Response platforms (SentinelOne, Microsoft Defender, CrowdStrike, or other toolsets).
• Strong experience with incident response, digital forensics, and threat hunting on endpoints.
• Knowledge of endpoint operating systems (Windows, macOS, and Linux).
• Experience with scripting (PowerShell, Python, or Bash) for automation and log parsing.
• Excellent analytical and problem-solving skills; ability to work in high-pressure situations.
• Effective verbal and written communication abilities.
• Detail-oriented with strong organizational skills and the ability to handle multiple priorities.
• Ability to work independently and within a collaborative, team-oriented environment.