Principal Security Engineer, Incident Response

The Principal Security Engineer, Incident Response will lead technical investigation and response for high-severity cybersecurity incidents across Advance Auto Parts’ enterprise environment. This senior role acts as a technical lead and escalation point within the Incident Response program, partnering with multiple teams to remediate incidents while reducing risk to business operations and reputation.

Incident Response Leadership

• Lead technical response to high-severity cybersecurity incidents from detection through closure.
• Serve as technical lead and deputy to the Incident Commander during major cybersecurity events.
• Act as the escalation point for junior incident responders when security events are complex or ambiguous.
• Produce clear, timely incident documentation, technical findings, and status updates for leadership.
• Model a culture of accountability, resilience, and continuous improvement.

Investigation, Forensics, and Threat Coverage

• Investigate and respond to ransomware, malware outbreaks, business email compromise, credential theft, cloud compromise, insider threats, and third-party breaches.
• Perform host, network, memory, log, and cloud forensic analysis to determine root cause, scope, and impact.
• Conduct proactive, hypothesis-driven threat hunts to identify advanced attacker activity.
• Leverage threat intelligence to enrich investigations and anticipate threat actor tactics, techniques, and procedures (TTPs) targeting the retail industry.

Containment, Eradication, and Recovery

• Execute containment, eradication, and recovery actions in coordination with Technology and business teams.
• Preserve evidence and maintain chain of custody in support of legal, regulatory, privacy, and cyber insurance requirements.
• Translate incident findings into new or improved detections aligned to MITRE ATT&CK.
• Partner with Engineering teams to tune monitoring technologies and improve signal-to-noise ratios.

Automation, Playbooks, and Continuous Improvement

• Identify opportunities to automate triage, enrichment, and response actions.
• Develop, maintain, and test incident response playbooks to keep them current and actionable.
• Support tabletop exercises, ransomware preparedness exercises, and cyber crisis simulations.
• Lead post-incident reviews and track corrective actions through completion.
• Contribute incident data to operational metrics, including Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).

Mentorship and Knowledge Sharing

• Mentor and develop junior incident responders through case reviews and hands-on coaching.
• Share knowledge through runbooks, training sessions, and lessons learned.

Collaboration and External Coordination

• Coordinate with external incident response retainers, forensic vendors, and law enforcement as directed.

Required Experience and Skills

• 6+ years of experience in cybersecurity, with at least 3 years focused on incident response, digital forensics, or threat hunting.
• Proven experience leading investigations of ransomware, business email compromise, cloud, and identity-based attacks.
• Hands-on expertise with security technologies including SIEM, SOAR, EDR, cloud security tools, and network and forensic analysis tools.
• Working knowledge of Windows, Linux, Active Directory/Entra ID, and major cloud platforms (AWS, Azure, or GCP).
• Experience with cybersecurity frameworks including NIST SP 800-61, NIST CSF, and MITRE ATT&CK.
• Scripting ability (Python, PowerShell, or similar) to support investigations and automation.
• Excellent written and verbal communication skills, including the ability to explain technical findings to non-technical audiences.

Technologies

• SIEM
• SOAR
• EDR
• Cloud security tools
• Network and forensic analysis tools
• Windows
• Linux
• Active Directory
• Entra ID
• AWS
• Azure
• GCP
• Python
• PowerShell
• NIST SP 800-61
• NIST CSF
• MITRE ATT&CK

Preferred Qualifications

• Certifications: GCIH, GCFA, GCFE, GNFA, GREM, CISSP
• Experience in large-scale, complex organizations, retail, or highly regulated industries.
• Expertise in cybersecurity automation and analytics.

Certifications

• GCIH
• GCFA
• GCFE
• GNFA
• GREM
• CISSP

Benefits

Comprehensive health & wellness benefits (see https://jobs.advanceautoparts.com/us/en/benefits).

Location and Work Availability

Hybrid role based at corporate headquarters in Raleigh, North Carolina (4 days in office, 1 day remote).