Senior Incident Response Engineer
Archer · San Jose, CA · 3 wk ago
Engineering$144k–$180k/yrFull-time
We need to output HTML fragment with sections using for headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections when posting has real specific content. We need to parse the job description.
We have:
- Overview: "Job Overview We are seeking a Senior Incident Response (IR) Engineer to lead Archer's detection and remediation efforts. You will serve as the primary technical liaison to our Managed Security Service Provider (MSSP), translating alerts into actionable responses while ensuring compliance with NIST SP 800-171. This role requires deep expertise in digital forensics, threat hunting, and enterprise security operations across SIEM, SOAR, and security platforms to collaborate with infrastructure and security teams to rapidly contain threats and improve our security posture."
That's prose; could be "About the role" section.
- Key Responsibilities: list of bullet points (starting with Serve as Archer's primary internal SIEM engineer...). So we need a Responsibilities section with
for headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections when posting has real specific content. We need to parse the job description.
We have:
- Overview: "Job Overview We are seeking a Senior Incident Response (IR) Engineer to lead Archer's detection and remediation efforts. You will serve as the primary technical liaison to our Managed Security Service Provider (MSSP), translating alerts into actionable responses while ensuring compliance with NIST SP 800-171. This role requires deep expertise in digital forensics, threat hunting, and enterprise security operations across SIEM, SOAR, and security platforms to collaborate with infrastructure and security teams to rapidly contain threats and improve our security posture."
That's prose; could be "About the role" section.
- Key Responsibilities: list of bullet points (starting with Serve as Archer's primary internal SIEM engineer...). So we need a Responsibilities section with - .
- Required Qualifications: list of bullet points (starting with 5+ years...). That's qualifications.
- Preferred Qualifications: also bullet points. Could be part of Qualifications or separate? The instruction: Use headings for sections like Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We have "Required Qualifications" and "Preferred Qualifications". Could combine into a Qualifications section (maybe with subheadings? but we only allowed
for sections; we could have one Qualifications section containing both required and preferred as separate maybe with headings inside? But we cannot add extra headings besides . Could embed paragraphs indicating required vs preferred. Probably better to have a Qualifications section with two lists, each preceded by a indicating required/preferred. That's acceptable.
- Skills: The posting includes many skill mentions inside qualifications; but we could also have a Skills section if there is explicit list. Not separate; we can incorporate into Qualifications.
- Benefits: Not mentioned explicitly. There's mention of pay range, but benefits not described. So we should not create Benefits section unless there is real content. There's no benefits description.
- Pay: The posting includes "For this position we are targeting a base pay between $144,000 - $180,000." That's pay info. So we need a Pay section with that content.
- Schedule: Not mentioned. So omit.
- About the role: we have overview.
- Responsibilities: we have.
- Requirements: maybe we could have a Requirements section separate from Qualifications? The posting has "Required Qualifications" and "Preferred Qualifications". Could treat "Required Qualifications" as Requirements. But we already have Qualifications heading. The instruction says use headings like Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we could have both Requirements and Qualifications sections. But we need to avoid duplication. Let's map:
- Requirements: maybe the mandatory qualifications (5+ years etc). Qualifications: maybe the preferred qualifications? Or we could combine. But we need to follow instruction: "Use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." It says e.g., not that we must use all. So we can choose which sections to include based on content.
Thus we can have:
About the role
with overview paragraph.
Responsibilities
with list.
Requirements
with required qualifications list.
Preferred Qualifications
maybe we could still use Qualifications heading for preferred? But we already used Requirements. Could have Qualifications for preferred. Or we could combine both under Qualifications with subheadings? But we cannot use etc. Could use
to label.
Better: Have Requirements (required) and Qualifications (preferred). That seems reasonable.
Pay section:
Pay
with paragraph.
We must not include boilerplate like EEO, etc. Remove all that.
We must preserve all substantive information; do not invent or summarize away detail. So we need to include all bullet points from responsibilities, required qualifications, preferred qualifications, and the pay range.
We must not repeat job title as heading. Already not.
We must not put Job ID/requisition numbers as headings; none present.
We must not include cookie/navigation/legal/EEO etc. So we need to strip those paragraphs at the end.
Let's extract the content.
First, overview paragraph: "We are seeking a Senior Incident Response (IR) Engineer to lead Archer's detection and remediation efforts. You will serve as the primary technical liaison to our Managed Security Service Provider (MSSP), translating alerts into actionable responses while ensuring compliance with NIST SP 800-171. This role requires deep expertise in digital forensics, threat hunting, and enterprise security operations across SIEM, SOAR, and security platforms to collaborate with infrastructure and security teams to rapidly contain threats and improve our security posture."
That's the overview.
Now responsibilities bullet points (starting with "Serve as Archer's primary internal SIEM engineer, working closely with internal resources and our MSSP for the triage & validation of alerts, defining escalation thresholds, and ensuring accurate tuning of security tools and detection rules." then each bullet separated by line breaks? Let's list them:
1. Serve as Archer's primary internal SIEM engineer, working closely with internal resources and our MSSP for the triage & validation of alerts, defining escalation thresholds, and ensuring accurate tuning of security tools and detection rules.
2. Lead the technical response to validated security incidents including identification, containment, eradication, and recovery, coordinating cross-functional response teams during breaches, malware outbreaks, and insider threats.
3. Conduct deep-dive forensic investigations including memory analysis, disk imaging, timeline reconstruction, and evidence preservation, producing detailed incident reports for HR, legal, and regulatory stakeholders.
4. Execute proactive threat hunts using SIEM data to identify lateral movement, persistence mechanisms, and indicators of compromise (IOCs).
5. Develop, refine, and validate custom detection rules mapped to the MITRE ATT&CK framework, considering Archer-specific threats and compliance-driven use cases.
6. Design and maintain incident response playbooks and SOAR workflows to automate evidence collection, containment actions, and notification procedures.
7. Design log collection requirements and facilitate external compliance audits to ensure adherence to NIST SP 800-171 Audit and Accountability (AU) requirements, CMMC Level 2 practices, and SOX ITGC expectations.
8. Manage endpoint and system detection policies, deploy sensors, and perform live response actions to contain active threats and collect forensic artifacts during incidents.
9. Identify and consume Archer-relevant cyber threat intelligence (CTI) feeds and operationalize IOCs and threat actor TTPs into detection logic.
10. Own the IR documentation architecture: author, organize, and continuously maintain incident response procedures, playbooks, and runbooks to ensure consistency, clarity, and audit-readiness.
11. Own and evolve Archer's IR program strategy, metrics, and roadmap, reporting progress and risk posture to the CISO and executive leadership.
12. Provide technical guidance and tabletop exercise facilitation to IT, application, and leadership teams on incident reporting procedures, response protocols, and lessons learned from post-incident reviews.
Now required qualifications bullet points:
- 5+ years in Incident Response or Security Operations (SOC), with proven experience managing MSSP relationships, alert triage, and SLA performance.
- Hands-on experience investigating security incidents from initial detection through containment and eradication, including malware analysis, phishing attacks, ransomware, and insider threats.
- Deep understanding of OS internals (Windows/Mac/Linux), network protocols, and proficiency in scripting (Python, PowerShell, Bash) for automation.
- Working knowledge of SIEM platforms (Google SecOps/Chronicle, Splunk, Microsoft Sentinel) and query languages (YARA-L/GoogleSQL, SPL, KQL) to hunt for threats and validate MSSP detections.
- Hands-on experience with SOAR platforms (Google SecOps/Chronicle, Palo Alto Cortex XSOAR, Splunk Phantom SOAR) to design and execute automated response workflows.
- Knowledge of Cyber Threat Intelligence standards and User Behavior Analytics (UEBA).
- Strong technical writing skills, with demonstrated experience authoring, structuring, and maintaining security documentation, including playbooks, runbooks, and incident response procedures.
- Demonstrated experience designing, leading, and facilitating tabletop exercises, purple team engagements, or incident simulations for technical and executive audiences.
- Demonstrated experience conducting proactive threat hunts using SIEM and EDR telemetry to identify lateral movement, persistence mechanisms, and indicators of compromise (IOCs).
- Broad security utility across the stack, with working familiarity with firewalls and network security, cloud security (AWS/Azure/GCP), and application security (AppSec) practices, enabling cross-domain support beyond core IR/SOC responsibilities.
- Excellent technical and executive writing and communication skills, with the ability to translate complex threat data and incident timelines for both technical teams and executive leadership during high-pressure situations.
Now preferred qualifications bullet points:
- Advanced malware analysis skills (static/dynamic) using IDA Pro, Ghidra, or Cuckoo Sandbox.
- Familiarity administering email security platforms (Material Security, ProofPoint, Check Point Harmony) and conducting phishing campaigns.
- Strong understanding of NIST SP 800-171 and CMMC Level 2 requirements, specifically as they relate to Incident Response (IR) and Audit/Accountability (AU).
- Familiarity with aerospace and startup environments.
Now pay: "For this position we are targeting a base pay between $144,000 - $180,000. Actual compensation offered will be determined by factors such as job-related knowledge, skills, and experience."
We should keep that sentence.
Now we need to output HTML fragment only.
We'll have:
About the role
We are seeking a Senior Incident Response (IR) Engineer to lead Archer's detection and remediation efforts. You will serve as the primary technical liaison to our Managed Security Service Provider (MSSP), translating alerts into actionable responses while ensuring compliance with NIST SP 800-171. This role requires deep expertise in digital forensics, threat hunting, and enterprise security operations across SIEM, SOAR, and security platforms to collaborate with infrastructure and security teams to rapidly contain threats and improve our security posture.
Responsibilities
- Serve as Archer's primary internal SIEM engineer, working closely with internal resources and our MSSP for the triage & validation of alerts, defining escalation thresholds, and ensuring accurate tuning of security tools and detection rules.
- Lead the technical response to validated security incidents including identification, containment, eradication, and recovery, coordinating cross-functional response teams during breaches, malware outbreaks, and insider threats.
- Conduct deep-dive forensic investigations including memory analysis, disk imaging, timeline reconstruction, and evidence preservation, producing detailed incident reports for HR, legal, and regulatory stakeholders.
- Execute proactive threat hunts using SIEM data to identify lateral movement, persistence mechanisms, and indicators of compromise (IOCs).
- Develop, refine, and validate custom detection rules mapped to the MITRE ATT&CK framework, considering Archer-specific threats and compliance-driven use cases.
- Design and maintain incident response playbooks and SOAR workflows to automate evidence collection, containment actions, and notification procedures.
- Design log collection requirements and facilitate external compliance audits to ensure adherence to NIST SP 800-171 Audit and Accountability (AU) requirements, CMMC Level 2 practices, and SOX ITGC expectations.
- Manage endpoint and system detection policies, deploy sensors, and perform live response actions to contain active threats and collect forensic artifacts during incidents.
- Identify
for sections; we could have one Qualifications section containing both required and preferred as separate maybe with headings inside? But we cannot add extra headings besides . Could embed paragraphs indicating required vs preferred. Probably better to have a Qualifications section with two lists, each preceded by a indicating required/preferred. That's acceptable.
- Skills: The posting includes many skill mentions inside qualifications; but we could also have a Skills section if there is explicit list. Not separate; we can incorporate into Qualifications.
- Benefits: Not mentioned explicitly. There's mention of pay range, but benefits not described. So we should not create Benefits section unless there is real content. There's no benefits description.
- Pay: The posting includes "For this position we are targeting a base pay between $144,000 - $180,000." That's pay info. So we need a Pay section with that content.
- Schedule: Not mentioned. So omit.
- About the role: we have overview.
- Responsibilities: we have.
- Requirements: maybe we could have a Requirements section separate from Qualifications? The posting has "Required Qualifications" and "Preferred Qualifications". Could treat "Required Qualifications" as Requirements. But we already have Qualifications heading. The instruction says use headings like Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we could have both Requirements and Qualifications sections. But we need to avoid duplication. Let's map:
- Requirements: maybe the mandatory qualifications (5+ years etc). Qualifications: maybe the preferred qualifications? Or we could combine. But we need to follow instruction: "Use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." It says e.g., not that we must use all. So we can choose which sections to include based on content.
Thus we can have:
About the role
with overview paragraph.
Responsibilities
with list.
Requirements
with required qualifications list.
Preferred Qualifications
maybe we could still use Qualifications heading for preferred? But we already used Requirements. Could have Qualifications for preferred. Or we could combine both under Qualifications with subheadings? But we cannot use etc. Could use
to label.
Better: Have Requirements (required) and Qualifications (preferred). That seems reasonable.
Pay section:
Pay
with paragraph.
We must not include boilerplate like EEO, etc. Remove all that.
We must preserve all substantive information; do not invent or summarize away detail. So we need to include all bullet points from responsibilities, required qualifications, preferred qualifications, and the pay range.
We must not repeat job title as heading. Already not.
We must not put Job ID/requisition numbers as headings; none present.
We must not include cookie/navigation/legal/EEO etc. So we need to strip those paragraphs at the end.
Let's extract the content.
First, overview paragraph: "We are seeking a Senior Incident Response (IR) Engineer to lead Archer's detection and remediation efforts. You will serve as the primary technical liaison to our Managed Security Service Provider (MSSP), translating alerts into actionable responses while ensuring compliance with NIST SP 800-171. This role requires deep expertise in digital forensics, threat hunting, and enterprise security operations across SIEM, SOAR, and security platforms to collaborate with infrastructure and security teams to rapidly contain threats and improve our security posture."
That's the overview.
Now responsibilities bullet points (starting with "Serve as Archer's primary internal SIEM engineer, working closely with internal resources and our MSSP for the triage & validation of alerts, defining escalation thresholds, and ensuring accurate tuning of security tools and detection rules." then each bullet separated by line breaks? Let's list them:
1. Serve as Archer's primary internal SIEM engineer, working closely with internal resources and our MSSP for the triage & validation of alerts, defining escalation thresholds, and ensuring accurate tuning of security tools and detection rules.
2. Lead the technical response to validated security incidents including identification, containment, eradication, and recovery, coordinating cross-functional response teams during breaches, malware outbreaks, and insider threats.
3. Conduct deep-dive forensic investigations including memory analysis, disk imaging, timeline reconstruction, and evidence preservation, producing detailed incident reports for HR, legal, and regulatory stakeholders.
4. Execute proactive threat hunts using SIEM data to identify lateral movement, persistence mechanisms, and indicators of compromise (IOCs).
5. Develop, refine, and validate custom detection rules mapped to the MITRE ATT&CK framework, considering Archer-specific threats and compliance-driven use cases.
6. Design and maintain incident response playbooks and SOAR workflows to automate evidence collection, containment actions, and notification procedures.
7. Design log collection requirements and facilitate external compliance audits to ensure adherence to NIST SP 800-171 Audit and Accountability (AU) requirements, CMMC Level 2 practices, and SOX ITGC expectations.
8. Manage endpoint and system detection policies, deploy sensors, and perform live response actions to contain active threats and collect forensic artifacts during incidents.
9. Identify and consume Archer-relevant cyber threat intelligence (CTI) feeds and operationalize IOCs and threat actor TTPs into detection logic.
10. Own the IR documentation architecture: author, organize, and continuously maintain incident response procedures, playbooks, and runbooks to ensure consistency, clarity, and audit-readiness.
11. Own and evolve Archer's IR program strategy, metrics, and roadmap, reporting progress and risk posture to the CISO and executive leadership.
12. Provide technical guidance and tabletop exercise facilitation to IT, application, and leadership teams on incident reporting procedures, response protocols, and lessons learned from post-incident reviews.
Now required qualifications bullet points:
- 5+ years in Incident Response or Security Operations (SOC), with proven experience managing MSSP relationships, alert triage, and SLA performance.
- Hands-on experience investigating security incidents from initial detection through containment and eradication, including malware analysis, phishing attacks, ransomware, and insider threats.
- Deep understanding of OS internals (Windows/Mac/Linux), network protocols, and proficiency in scripting (Python, PowerShell, Bash) for automation.
- Working knowledge of SIEM platforms (Google SecOps/Chronicle, Splunk, Microsoft Sentinel) and query languages (YARA-L/GoogleSQL, SPL, KQL) to hunt for threats and validate MSSP detections.
- Hands-on experience with SOAR platforms (Google SecOps/Chronicle, Palo Alto Cortex XSOAR, Splunk Phantom SOAR) to design and execute automated response workflows.
- Knowledge of Cyber Threat Intelligence standards and User Behavior Analytics (UEBA).
- Strong technical writing skills, with demonstrated experience authoring, structuring, and maintaining security documentation, including playbooks, runbooks, and incident response procedures.
- Demonstrated experience designing, leading, and facilitating tabletop exercises, purple team engagements, or incident simulations for technical and executive audiences.
- Demonstrated experience conducting proactive threat hunts using SIEM and EDR telemetry to identify lateral movement, persistence mechanisms, and indicators of compromise (IOCs).
- Broad security utility across the stack, with working familiarity with firewalls and network security, cloud security (AWS/Azure/GCP), and application security (AppSec) practices, enabling cross-domain support beyond core IR/SOC responsibilities.
- Excellent technical and executive writing and communication skills, with the ability to translate complex threat data and incident timelines for both technical teams and executive leadership during high-pressure situations.
Now preferred qualifications bullet points:
- Advanced malware analysis skills (static/dynamic) using IDA Pro, Ghidra, or Cuckoo Sandbox.
- Familiarity administering email security platforms (Material Security, ProofPoint, Check Point Harmony) and conducting phishing campaigns.
- Strong understanding of NIST SP 800-171 and CMMC Level 2 requirements, specifically as they relate to Incident Response (IR) and Audit/Accountability (AU).
- Familiarity with aerospace and startup environments.
Now pay: "For this position we are targeting a base pay between $144,000 - $180,000. Actual compensation offered will be determined by factors such as job-related knowledge, skills, and experience."
We should keep that sentence.
Now we need to output HTML fragment only.
We'll have:
About the role
We are seeking a Senior Incident Response (IR) Engineer to lead Archer's detection and remediation efforts. You will serve as the primary technical liaison to our Managed Security Service Provider (MSSP), translating alerts into actionable responses while ensuring compliance with NIST SP 800-171. This role requires deep expertise in digital forensics, threat hunting, and enterprise security operations across SIEM, SOAR, and security platforms to collaborate with infrastructure and security teams to rapidly contain threats and improve our security posture.
Responsibilities
- Serve as Archer's primary internal SIEM engineer, working closely with internal resources and our MSSP for the triage & validation of alerts, defining escalation thresholds, and ensuring accurate tuning of security tools and detection rules.
- Lead the technical response to validated security incidents including identification, containment, eradication, and recovery, coordinating cross-functional response teams during breaches, malware outbreaks, and insider threats.
- Conduct deep-dive forensic investigations including memory analysis, disk imaging, timeline reconstruction, and evidence preservation, producing detailed incident reports for HR, legal, and regulatory stakeholders.
- Execute proactive threat hunts using SIEM data to identify lateral movement, persistence mechanisms, and indicators of compromise (IOCs).
- Develop, refine, and validate custom detection rules mapped to the MITRE ATT&CK framework, considering Archer-specific threats and compliance-driven use cases.
- Design and maintain incident response playbooks and SOAR workflows to automate evidence collection, containment actions, and notification procedures.
- Design log collection requirements and facilitate external compliance audits to ensure adherence to NIST SP 800-171 Audit and Accountability (AU) requirements, CMMC Level 2 practices, and SOX ITGC expectations.
- Manage endpoint and system detection policies, deploy sensors, and perform live response actions to contain active threats and collect forensic artifacts during incidents.
- Identify
. Could embed paragraphs indicating required vs preferred. Probably better to have a Qualifications section with two lists, each preceded by a indicating required/preferred. That's acceptable.
- Skills: The posting includes many skill mentions inside qualifications; but we could also have a Skills section if there is explicit list. Not separate; we can incorporate into Qualifications.
- Benefits: Not mentioned explicitly. There's mention of pay range, but benefits not described. So we should not create Benefits section unless there is real content. There's no benefits description.
- Pay: The posting includes "For this position we are targeting a base pay between $144,000 - $180,000." That's pay info. So we need a Pay section with that content.
- Schedule: Not mentioned. So omit.
- About the role: we have overview.
- Responsibilities: we have.
- Requirements: maybe we could have a Requirements section separate from Qualifications? The posting has "Required Qualifications" and "Preferred Qualifications". Could treat "Required Qualifications" as Requirements. But we already have Qualifications heading. The instruction says use headings like Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we could have both Requirements and Qualifications sections. But we need to avoid duplication. Let's map:
- Requirements: maybe the mandatory qualifications (5+ years etc). Qualifications: maybe the preferred qualifications? Or we could combine. But we need to follow instruction: "Use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." It says e.g., not that we must use all. So we can choose which sections to include based on content.
Thus we can have:
About the role
with overview paragraph.
Responsibilities
with list.
Requirements
with required qualifications list.
Preferred Qualifications
maybe we could still use Qualifications heading for preferred? But we already used Requirements. Could have Qualifications for preferred. Or we could combine both under Qualifications with subheadings? But we cannot use etc. Could use
to label.
Better: Have Requirements (required) and Qualifications (preferred). That seems reasonable.
Pay section:
Pay
with paragraph.
We must not include boilerplate like EEO, etc. Remove all that.
We must preserve all substantive information; do not invent or summarize away detail. So we need to include all bullet points from responsibilities, required qualifications, preferred qualifications, and the pay range.
We must not repeat job title as heading. Already not.
We must not put Job ID/requisition numbers as headings; none present.
We must not include cookie/navigation/legal/EEO etc. So we need to strip those paragraphs at the end.
Let's extract the content.
First, overview paragraph: "We are seeking a Senior Incident Response (IR) Engineer to lead Archer's detection and remediation efforts. You will serve as the primary technical liaison to our Managed Security Service Provider (MSSP), translating alerts into actionable responses while ensuring compliance with NIST SP 800-171. This role requires deep expertise in digital forensics, threat hunting, and enterprise security operations across SIEM, SOAR, and security platforms to collaborate with infrastructure and security teams to rapidly contain threats and improve our security posture."
That's the overview.
Now responsibilities bullet points (starting with "Serve as Archer's primary internal SIEM engineer, working closely with internal resources and our MSSP for the triage & validation of alerts, defining escalation thresholds, and ensuring accurate tuning of security tools and detection rules." then each bullet separated by line breaks? Let's list them:
1. Serve as Archer's primary internal SIEM engineer, working closely with internal resources and our MSSP for the triage & validation of alerts, defining escalation thresholds, and ensuring accurate tuning of security tools and detection rules.
2. Lead the technical response to validated security incidents including identification, containment, eradication, and recovery, coordinating cross-functional response teams during breaches, malware outbreaks, and insider threats.
3. Conduct deep-dive forensic investigations including memory analysis, disk imaging, timeline reconstruction, and evidence preservation, producing detailed incident reports for HR, legal, and regulatory stakeholders.
4. Execute proactive threat hunts using SIEM data to identify lateral movement, persistence mechanisms, and indicators of compromise (IOCs).
5. Develop, refine, and validate custom detection rules mapped to the MITRE ATT&CK framework, considering Archer-specific threats and compliance-driven use cases.
6. Design and maintain incident response playbooks and SOAR workflows to automate evidence collection, containment actions, and notification procedures.
7. Design log collection requirements and facilitate external compliance audits to ensure adherence to NIST SP 800-171 Audit and Accountability (AU) requirements, CMMC Level 2 practices, and SOX ITGC expectations.
8. Manage endpoint and system detection policies, deploy sensors, and perform live response actions to contain active threats and collect forensic artifacts during incidents.
9. Identify and consume Archer-relevant cyber threat intelligence (CTI) feeds and operationalize IOCs and threat actor TTPs into detection logic.
10. Own the IR documentation architecture: author, organize, and continuously maintain incident response procedures, playbooks, and runbooks to ensure consistency, clarity, and audit-readiness.
11. Own and evolve Archer's IR program strategy, metrics, and roadmap, reporting progress and risk posture to the CISO and executive leadership.
12. Provide technical guidance and tabletop exercise facilitation to IT, application, and leadership teams on incident reporting procedures, response protocols, and lessons learned from post-incident reviews.
Now required qualifications bullet points:
- 5+ years in Incident Response or Security Operations (SOC), with proven experience managing MSSP relationships, alert triage, and SLA performance.
- Hands-on experience investigating security incidents from initial detection through containment and eradication, including malware analysis, phishing attacks, ransomware, and insider threats.
- Deep understanding of OS internals (Windows/Mac/Linux), network protocols, and proficiency in scripting (Python, PowerShell, Bash) for automation.
- Working knowledge of SIEM platforms (Google SecOps/Chronicle, Splunk, Microsoft Sentinel) and query languages (YARA-L/GoogleSQL, SPL, KQL) to hunt for threats and validate MSSP detections.
- Hands-on experience with SOAR platforms (Google SecOps/Chronicle, Palo Alto Cortex XSOAR, Splunk Phantom SOAR) to design and execute automated response workflows.
- Knowledge of Cyber Threat Intelligence standards and User Behavior Analytics (UEBA).
- Strong technical writing skills, with demonstrated experience authoring, structuring, and maintaining security documentation, including playbooks, runbooks, and incident response procedures.
- Demonstrated experience designing, leading, and facilitating tabletop exercises, purple team engagements, or incident simulations for technical and executive audiences.
- Demonstrated experience conducting proactive threat hunts using SIEM and EDR telemetry to identify lateral movement, persistence mechanisms, and indicators of compromise (IOCs).
- Broad security utility across the stack, with working familiarity with firewalls and network security, cloud security (AWS/Azure/GCP), and application security (AppSec) practices, enabling cross-domain support beyond core IR/SOC responsibilities.
- Excellent technical and executive writing and communication skills, with the ability to translate complex threat data and incident timelines for both technical teams and executive leadership during high-pressure situations.
Now preferred qualifications bullet points:
- Advanced malware analysis skills (static/dynamic) using IDA Pro, Ghidra, or Cuckoo Sandbox.
- Familiarity administering email security platforms (Material Security, ProofPoint, Check Point Harmony) and conducting phishing campaigns.
- Strong understanding of NIST SP 800-171 and CMMC Level 2 requirements, specifically as they relate to Incident Response (IR) and Audit/Accountability (AU).
- Familiarity with aerospace and startup environments.
Now pay: "For this position we are targeting a base pay between $144,000 - $180,000. Actual compensation offered will be determined by factors such as job-related knowledge, skills, and experience."
We should keep that sentence.
Now we need to output HTML fragment only.
We'll have:
About the role
We are seeking a Senior Incident Response (IR) Engineer to lead Archer's detection and remediation efforts. You will serve as the primary technical liaison to our Managed Security Service Provider (MSSP), translating alerts into actionable responses while ensuring compliance with NIST SP 800-171. This role requires deep expertise in digital forensics, threat hunting, and enterprise security operations across SIEM, SOAR, and security platforms to collaborate with infrastructure and security teams to rapidly contain threats and improve our security posture.
Responsibilities
- Serve as Archer's primary internal SIEM engineer, working closely with internal resources and our MSSP for the triage & validation of alerts, defining escalation thresholds, and ensuring accurate tuning of security tools and detection rules.
- Lead the technical response to validated security incidents including identification, containment, eradication, and recovery, coordinating cross-functional response teams during breaches, malware outbreaks, and insider threats.
- Conduct deep-dive forensic investigations including memory analysis, disk imaging, timeline reconstruction, and evidence preservation, producing detailed incident reports for HR, legal, and regulatory stakeholders.
- Execute proactive threat hunts using SIEM data to identify lateral movement, persistence mechanisms, and indicators of compromise (IOCs).
- Develop, refine, and validate custom detection rules mapped to the MITRE ATT&CK framework, considering Archer-specific threats and compliance-driven use cases.
- Design and maintain incident response playbooks and SOAR workflows to automate evidence collection, containment actions, and notification procedures.
- Design log collection requirements and facilitate external compliance audits to ensure adherence to NIST SP 800-171 Audit and Accountability (AU) requirements, CMMC Level 2 practices, and SOX ITGC expectations.
- Manage endpoint and system detection policies, deploy sensors, and perform live response actions to contain active threats and collect forensic artifacts during incidents.
- Identify
indicating required/preferred. That's acceptable. - Skills: The posting includes many skill mentions inside qualifications; but we could also have a Skills section if there is explicit list. Not separate; we can incorporate into Qualifications. - Benefits: Not mentioned explicitly. There's mention of pay range, but benefits not described. So we should not create Benefits section unless there is real content. There's no benefits description. - Pay: The posting includes "For this position we are targeting a base pay between $144,000 - $180,000." That's pay info. So we need a Pay section with that content. - Schedule: Not mentioned. So omit. - About the role: we have overview. - Responsibilities: we have. - Requirements: maybe we could have a Requirements section separate from Qualifications? The posting has "Required Qualifications" and "Preferred Qualifications". Could treat "Required Qualifications" as Requirements. But we already have Qualifications heading. The instruction says use headings like Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we could have both Requirements and Qualifications sections. But we need to avoid duplication. Let's map: - Requirements: maybe the mandatory qualifications (5+ years etc). Qualifications: maybe the preferred qualifications? Or we could combine. But we need to follow instruction: "Use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." It says e.g., not that we must use all. So we can choose which sections to include based on content.
Thus we can have:
About the role
with overview paragraph.
Responsibilities
with list.
Requirements
with required qualifications list.
Preferred Qualifications
maybe we could still use Qualifications heading for preferred? But we already used Requirements. Could have Qualifications for preferred. Or we could combine both under Qualifications with subheadings? But we cannot use etc. Could use
to label.
Better: Have Requirements (required) and Qualifications (preferred). That seems reasonable.
Pay section:
Pay
with paragraph.
We must not include boilerplate like EEO, etc. Remove all that.
We must preserve all substantive information; do not invent or summarize away detail. So we need to include all bullet points from responsibilities, required qualifications, preferred qualifications, and the pay range.
We must not repeat job title as heading. Already not.
We must not put Job ID/requisition numbers as headings; none present.
We must not include cookie/navigation/legal/EEO etc. So we need to strip those paragraphs at the end.
Let's extract the content.
First, overview paragraph: "We are seeking a Senior Incident Response (IR) Engineer to lead Archer's detection and remediation efforts. You will serve as the primary technical liaison to our Managed Security Service Provider (MSSP), translating alerts into actionable responses while ensuring compliance with NIST SP 800-171. This role requires deep expertise in digital forensics, threat hunting, and enterprise security operations across SIEM, SOAR, and security platforms to collaborate with infrastructure and security teams to rapidly contain threats and improve our security posture."
That's the overview.
Now responsibilities bullet points (starting with "Serve as Archer's primary internal SIEM engineer, working closely with internal resources and our MSSP for the triage & validation of alerts, defining escalation thresholds, and ensuring accurate tuning of security tools and detection rules." then each bullet separated by line breaks? Let's list them:
1. Serve as Archer's primary internal SIEM engineer, working closely with internal resources and our MSSP for the triage & validation of alerts, defining escalation thresholds, and ensuring accurate tuning of security tools and detection rules.
2. Lead the technical response to validated security incidents including identification, containment, eradication, and recovery, coordinating cross-functional response teams during breaches, malware outbreaks, and insider threats.
3. Conduct deep-dive forensic investigations including memory analysis, disk imaging, timeline reconstruction, and evidence preservation, producing detailed incident reports for HR, legal, and regulatory stakeholders.
4. Execute proactive threat hunts using SIEM data to identify lateral movement, persistence mechanisms, and indicators of compromise (IOCs).
5. Develop, refine, and validate custom detection rules mapped to the MITRE ATT&CK framework, considering Archer-specific threats and compliance-driven use cases.
6. Design and maintain incident response playbooks and SOAR workflows to automate evidence collection, containment actions, and notification procedures.
7. Design log collection requirements and facilitate external compliance audits to ensure adherence to NIST SP 800-171 Audit and Accountability (AU) requirements, CMMC Level 2 practices, and SOX ITGC expectations.
8. Manage endpoint and system detection policies, deploy sensors, and perform live response actions to contain active threats and collect forensic artifacts during incidents.
9. Identify and consume Archer-relevant cyber threat intelligence (CTI) feeds and operationalize IOCs and threat actor TTPs into detection logic.
10. Own the IR documentation architecture: author, organize, and continuously maintain incident response procedures, playbooks, and runbooks to ensure consistency, clarity, and audit-readiness.
11. Own and evolve Archer's IR program strategy, metrics, and roadmap, reporting progress and risk posture to the CISO and executive leadership.
12. Provide technical guidance and tabletop exercise facilitation to IT, application, and leadership teams on incident reporting procedures, response protocols, and lessons learned from post-incident reviews.
Now required qualifications bullet points:
- 5+ years in Incident Response or Security Operations (SOC), with proven experience managing MSSP relationships, alert triage, and SLA performance.
- Hands-on experience investigating security incidents from initial detection through containment and eradication, including malware analysis, phishing attacks, ransomware, and insider threats.
- Deep understanding of OS internals (Windows/Mac/Linux), network protocols, and proficiency in scripting (Python, PowerShell, Bash) for automation.
- Working knowledge of SIEM platforms (Google SecOps/Chronicle, Splunk, Microsoft Sentinel) and query languages (YARA-L/GoogleSQL, SPL, KQL) to hunt for threats and validate MSSP detections.
- Hands-on experience with SOAR platforms (Google SecOps/Chronicle, Palo Alto Cortex XSOAR, Splunk Phantom SOAR) to design and execute automated response workflows.
- Knowledge of Cyber Threat Intelligence standards and User Behavior Analytics (UEBA).
- Strong technical writing skills, with demonstrated experience authoring, structuring, and maintaining security documentation, including playbooks, runbooks, and incident response procedures.
- Demonstrated experience designing, leading, and facilitating tabletop exercises, purple team engagements, or incident simulations for technical and executive audiences.
- Demonstrated experience conducting proactive threat hunts using SIEM and EDR telemetry to identify lateral movement, persistence mechanisms, and indicators of compromise (IOCs).
- Broad security utility across the stack, with working familiarity with firewalls and network security, cloud security (AWS/Azure/GCP), and application security (AppSec) practices, enabling cross-domain support beyond core IR/SOC responsibilities.
- Excellent technical and executive writing and communication skills, with the ability to translate complex threat data and incident timelines for both technical teams and executive leadership during high-pressure situations.
Now preferred qualifications bullet points:
- Advanced malware analysis skills (static/dynamic) using IDA Pro, Ghidra, or Cuckoo Sandbox.
- Familiarity administering email security platforms (Material Security, ProofPoint, Check Point Harmony) and conducting phishing campaigns.
- Strong understanding of NIST SP 800-171 and CMMC Level 2 requirements, specifically as they relate to Incident Response (IR) and Audit/Accountability (AU).
- Familiarity with aerospace and startup environments.
Now pay: "For this position we are targeting a base pay between $144,000 - $180,000. Actual compensation offered will be determined by factors such as job-related knowledge, skills, and experience."
We should keep that sentence.
Now we need to output HTML fragment only.
We'll have:
About the role
We are seeking a Senior Incident Response (IR) Engineer to lead Archer's detection and remediation efforts. You will serve as the primary technical liaison to our Managed Security Service Provider (MSSP), translating alerts into actionable responses while ensuring compliance with NIST SP 800-171. This role requires deep expertise in digital forensics, threat hunting, and enterprise security operations across SIEM, SOAR, and security platforms to collaborate with infrastructure and security teams to rapidly contain threats and improve our security posture.
Responsibilities
- Serve as Archer's primary internal SIEM engineer, working closely with internal resources and our MSSP for the triage & validation of alerts, defining escalation thresholds, and ensuring accurate tuning of security tools and detection rules.
- Lead the technical response to validated security incidents including identification, containment, eradication, and recovery, coordinating cross-functional response teams during breaches, malware outbreaks, and insider threats.
- Conduct deep-dive forensic investigations including memory analysis, disk imaging, timeline reconstruction, and evidence preservation, producing detailed incident reports for HR, legal, and regulatory stakeholders.
- Execute proactive threat hunts using SIEM data to identify lateral movement, persistence mechanisms, and indicators of compromise (IOCs).
- Develop, refine, and validate custom detection rules mapped to the MITRE ATT&CK framework, considering Archer-specific threats and compliance-driven use cases.
- Design and maintain incident response playbooks and SOAR workflows to automate evidence collection, containment actions, and notification procedures.
- Design log collection requirements and facilitate external compliance audits to ensure adherence to NIST SP 800-171 Audit and Accountability (AU) requirements, CMMC Level 2 practices, and SOX ITGC expectations.
- Manage endpoint and system detection policies, deploy sensors, and perform live response actions to contain active threats and collect forensic artifacts during incidents.
- Identify
Requirements
with required qualifications list.Preferred Qualifications
maybe we could still use Qualifications heading for preferred? But we already used Requirements. Could have Qualifications for preferred. Or we could combine both under Qualifications with subheadings? But we cannot useetc. Could use
to label. Better: Have Requirements (required) and Qualifications (preferred). That seems reasonable. Pay section:
Pay
with paragraph. We must not include boilerplate like EEO, etc. Remove all that. We must preserve all substantive information; do not invent or summarize away detail. So we need to include all bullet points from responsibilities, required qualifications, preferred qualifications, and the pay range. We must not repeat job title as heading. Already not. We must not put Job ID/requisition numbers as headings; none present. We must not include cookie/navigation/legal/EEO etc. So we need to strip those paragraphs at the end. Let's extract the content. First, overview paragraph: "We are seeking a Senior Incident Response (IR) Engineer to lead Archer's detection and remediation efforts. You will serve as the primary technical liaison to our Managed Security Service Provider (MSSP), translating alerts into actionable responses while ensuring compliance with NIST SP 800-171. This role requires deep expertise in digital forensics, threat hunting, and enterprise security operations across SIEM, SOAR, and security platforms to collaborate with infrastructure and security teams to rapidly contain threats and improve our security posture." That's the overview. Now responsibilities bullet points (starting with "Serve as Archer's primary internal SIEM engineer, working closely with internal resources and our MSSP for the triage & validation of alerts, defining escalation thresholds, and ensuring accurate tuning of security tools and detection rules." then each bullet separated by line breaks? Let's list them: 1. Serve as Archer's primary internal SIEM engineer, working closely with internal resources and our MSSP for the triage & validation of alerts, defining escalation thresholds, and ensuring accurate tuning of security tools and detection rules. 2. Lead the technical response to validated security incidents including identification, containment, eradication, and recovery, coordinating cross-functional response teams during breaches, malware outbreaks, and insider threats. 3. Conduct deep-dive forensic investigations including memory analysis, disk imaging, timeline reconstruction, and evidence preservation, producing detailed incident reports for HR, legal, and regulatory stakeholders. 4. Execute proactive threat hunts using SIEM data to identify lateral movement, persistence mechanisms, and indicators of compromise (IOCs). 5. Develop, refine, and validate custom detection rules mapped to the MITRE ATT&CK framework, considering Archer-specific threats and compliance-driven use cases. 6. Design and maintain incident response playbooks and SOAR workflows to automate evidence collection, containment actions, and notification procedures. 7. Design log collection requirements and facilitate external compliance audits to ensure adherence to NIST SP 800-171 Audit and Accountability (AU) requirements, CMMC Level 2 practices, and SOX ITGC expectations. 8. Manage endpoint and system detection policies, deploy sensors, and perform live response actions to contain active threats and collect forensic artifacts during incidents. 9. Identify and consume Archer-relevant cyber threat intelligence (CTI) feeds and operationalize IOCs and threat actor TTPs into detection logic. 10. Own the IR documentation architecture: author, organize, and continuously maintain incident response procedures, playbooks, and runbooks to ensure consistency, clarity, and audit-readiness. 11. Own and evolve Archer's IR program strategy, metrics, and roadmap, reporting progress and risk posture to the CISO and executive leadership. 12. Provide technical guidance and tabletop exercise facilitation to IT, application, and leadership teams on incident reporting procedures, response protocols, and lessons learned from post-incident reviews. Now required qualifications bullet points: - 5+ years in Incident Response or Security Operations (SOC), with proven experience managing MSSP relationships, alert triage, and SLA performance. - Hands-on experience investigating security incidents from initial detection through containment and eradication, including malware analysis, phishing attacks, ransomware, and insider threats. - Deep understanding of OS internals (Windows/Mac/Linux), network protocols, and proficiency in scripting (Python, PowerShell, Bash) for automation. - Working knowledge of SIEM platforms (Google SecOps/Chronicle, Splunk, Microsoft Sentinel) and query languages (YARA-L/GoogleSQL, SPL, KQL) to hunt for threats and validate MSSP detections. - Hands-on experience with SOAR platforms (Google SecOps/Chronicle, Palo Alto Cortex XSOAR, Splunk Phantom SOAR) to design and execute automated response workflows. - Knowledge of Cyber Threat Intelligence standards and User Behavior Analytics (UEBA). - Strong technical writing skills, with demonstrated experience authoring, structuring, and maintaining security documentation, including playbooks, runbooks, and incident response procedures. - Demonstrated experience designing, leading, and facilitating tabletop exercises, purple team engagements, or incident simulations for technical and executive audiences. - Demonstrated experience conducting proactive threat hunts using SIEM and EDR telemetry to identify lateral movement, persistence mechanisms, and indicators of compromise (IOCs). - Broad security utility across the stack, with working familiarity with firewalls and network security, cloud security (AWS/Azure/GCP), and application security (AppSec) practices, enabling cross-domain support beyond core IR/SOC responsibilities. - Excellent technical and executive writing and communication skills, with the ability to translate complex threat data and incident timelines for both technical teams and executive leadership during high-pressure situations. Now preferred qualifications bullet points: - Advanced malware analysis skills (static/dynamic) using IDA Pro, Ghidra, or Cuckoo Sandbox. - Familiarity administering email security platforms (Material Security, ProofPoint, Check Point Harmony) and conducting phishing campaigns. - Strong understanding of NIST SP 800-171 and CMMC Level 2 requirements, specifically as they relate to Incident Response (IR) and Audit/Accountability (AU). - Familiarity with aerospace and startup environments. Now pay: "For this position we are targeting a base pay between $144,000 - $180,000. Actual compensation offered will be determined by factors such as job-related knowledge, skills, and experience." We should keep that sentence. Now we need to output HTML fragment only. We'll have:About the role
We are seeking a Senior Incident Response (IR) Engineer to lead Archer's detection and remediation efforts. You will serve as the primary technical liaison to our Managed Security Service Provider (MSSP), translating alerts into actionable responses while ensuring compliance with NIST SP 800-171. This role requires deep expertise in digital forensics, threat hunting, and enterprise security operations across SIEM, SOAR, and security platforms to collaborate with infrastructure and security teams to rapidly contain threats and improve our security posture.
Responsibilities
- Serve as Archer's primary internal SIEM engineer, working closely with internal resources and our MSSP for the triage & validation of alerts, defining escalation thresholds, and ensuring accurate tuning of security tools and detection rules.
- Lead the technical response to validated security incidents including identification, containment, eradication, and recovery, coordinating cross-functional response teams during breaches, malware outbreaks, and insider threats.
- Conduct deep-dive forensic investigations including memory analysis, disk imaging, timeline reconstruction, and evidence preservation, producing detailed incident reports for HR, legal, and regulatory stakeholders.
- Execute proactive threat hunts using SIEM data to identify lateral movement, persistence mechanisms, and indicators of compromise (IOCs).
- Develop, refine, and validate custom detection rules mapped to the MITRE ATT&CK framework, considering Archer-specific threats and compliance-driven use cases.
- Design and maintain incident response playbooks and SOAR workflows to automate evidence collection, containment actions, and notification procedures.
- Design log collection requirements and facilitate external compliance audits to ensure adherence to NIST SP 800-171 Audit and Accountability (AU) requirements, CMMC Level 2 practices, and SOX ITGC expectations.
- Manage endpoint and system detection policies, deploy sensors, and perform live response actions to contain active threats and collect forensic artifacts during incidents.
- Identify