Lead Detection & Response Platform Engineer

What you'll do

• Define and standardize alert triage processes for classification, prioritization, investigation, and escalation.
• Build SOAR playbooks, enrichment pipelines, and case-management workflows to automate repetitive analyst tasks.
• Manage the SIEM, XDR, and SOAR platforms using version control, peer review, and automated deployment.
• Measure and analyze triage performance metrics to identify areas for tuning, automation, or retirement.
• Coordinate enterprise-wide incident response and lead significant incidents with technical, business, and legal stakeholders.
• Maintain the Incident Response Plan and conduct quarterly tabletop exercises to update playbooks and automation.
• Mentor analysts and engineers in process design, investigation methods, and automation development.
• Connect telemetry across identity, endpoint, cloud, and network tools through API integrations.

What we're looking for

• Bachelor’s Degree from an accredited, not for profit, in person, university or college.
• 8+ years in IT, including 5+ years in cybersecurity and at least 3 years in security operations, detection engineering, or incident response.
• One or more security certifications such as GIAC GCIH, GCDA, CISSP, CISM, or ECIH.
• Experience designing and running alert triage or incident response processes for an enterprise security operations team.
• Experience building and maintaining production security automation in a SOAR or workflow platform using playbooks and API integrations.
• Proficiency in Python or PowerShell, REST APIs, JSON, and at least one SIEM query language like KQL or SPL.
• Experience managing security content or configuration with Git and a change-control process.
• Experience investigating across identity (Active Directory / Entra ID), endpoint, cloud, and email telemetry.