Security Incident Response Engineer

Incident Response Operations 

• Investigate and respond to cybersecurity incidents involving endpoints, identities, cloud platforms, email systems, applications, data, and network infrastructure. 
• Perform incident triage, severity classification, impact analysis, containment, eradication, and recovery activities. 
• Execute cyber incident response procedures and escalation processes in accordance with the Cyber Incident Response Plan (CIRP). 
• Coordinate response efforts across Security, Infrastructure, Cloud, IAM, Workplace Technology, Legal, Privacy, Human Resources, and business teams. 
• Support major incident management activities and provide technical leadership during active security events. 
• Maintain detailed incident records, timelines, evidence, findings, and lessons learned. 

Threat Detection and Investigation 

• Analyze alerts generated by EDR, SIEM, MDR, email security, cloud security, deception, and threat intelligence platforms. 
• Validate suspicious activity to distinguish true security incidents from false positives. 
• Perform root cause analysis to identify attack vectors, affected assets, compromised accounts, and attacker activities. 
• Conduct proactive threat hunting to identify indicators of compromise, adversary behaviors, and emerging threats. 
• Leverage MITRE ATT&CK techniques to improve detection and investigative effectiveness. 

Digital Forensics and Evidence Collection 

• Collect, preserve, and analyze system, endpoint, cloud, email, and identity-related evidence. 
• Perform log analysis, forensic triage, malware investigation, and timeline reconstruction. 
• Support legal, regulatory, audit, and compliance investigations as required. 
• Maintain evidence handling and chain-of-custody procedures where applicable. 

Security Engineering and Continuous Improvement 

• Develop and maintain incident response playbooks, investigation procedures, and operational runbooks. 
• Recommend detection improvements, new use cases, automations, and response capabilities. 
• Tune security alerts and detection logic to improve fidelity and reduce false positives. 
• Assist in the implementation and improvement of SOAR workflows and automated response capabilities. 
• Participate in tabletop exercises, incident simulations, and purple team activities. 

Metrics and Reporting 

• Track and report operational metrics including:  
• Mean Time to Detect (MTTD) 
• Mean Time to Respond (MTTR) 
• Incident volume 
• Severity trends 
• Containment effectiveness 
• Detection fidelity 
• Produce incident reports, executive summaries, and post-incident reviews. 
• Identify recurring trends and recommend corrective actions. 

Collaboration and Enablement 

• Partner with Security Engineering teams to improve telemetry, monitoring, and investigative capabilities. 
• Work with Vulnerability Management and Exposure Management teams on remediation activities resulting from incidents. 
• Provide guidance and mentorship to analysts and junior responders. 
• Participate in after-hours incident response and on-call rotations as required.