Staff Cyber Incident Response Engineer

What you'll do

• Lead and conduct host forensics, network forensics, log analysis, and malware triage to support investigations.
• Create and enhance scripts, tools, and methodologies to automate incident investigation processes.
• Provide leadership and mentorship to the incident response team as a technical resource.
• Draft detailed reports, assign remediation actions, and implement process improvements for internal and external partners.
• Develop and present technical and non-technical training sessions and presentations.
• Conduct tabletop exercises and incident simulations to ensure organizational readiness.
• Perform proactive and iterative threat hunts across cloud and enterprise networks to detect malicious activities.

What we're looking for

• 7+ years of proven experience in end-to-end incident response processes, including leading complex, multi-functional incidents.
• Strong investigative background with expertise in Windows analysis and forensics.
• Experience working in container environments such as Kubernetes and Docker.
• Hands-on experience with various Endpoint Detection and Response (EDR) solutions.
• Deep understanding of the internals and constructs of Linux, MacOS, and Windows operating systems.
• Extensive experience in administering, attacking, or defending cloud environments (AWS, Azure, GCP).
• Deep understanding of logs from cloud, network, and endpoint devices.
• Excellent skills in writing complex searches or analytics for popular Security Information and Event Management (SIEM) solutions.
• Proficiency in bash and at least one interpreted programming language like Python or Ruby.