Ransomware Response Engineer Jobs

1 job found

Today

Principal Security Engineer, Incident Response

Advance Auto Parts Raleigh, NC

Raleigh, NC

Today

Full time Cloud Platforms Cybersecurity Operations Cybersecurity Tools

Apply Now

Job Description

The Principal Security Engineer, Incident Response will lead technical investigation and response for high-severity cybersecurity incidents across Advance Auto Parts’ enterprise environment. This senior role acts as a technical lead and escalation point within the Incident Response program, partnering with multiple teams to remediate incidents while reducing risk to business operations and reputation.

Incident Response Leadership

Lead technical response to high-severity cybersecurity incidents from detection through closure.
Serve as technical lead and deputy to the Incident Commander during major cybersecurity events.
Act as the escalation point for junior incident responders when security events are complex or ambiguous.
Produce clear, timely incident documentation, technical findings, and status updates for leadership.
Model a culture of accountability, resilience, and continuous improvement.

Investigation, Forensics, and Threat Coverage

Investigate and respond to ransomware, malware outbreaks, business email compromise, credential theft, cloud compromise, insider threats, and third-party breaches.
Perform host, network, memory, log, and cloud forensic analysis to determine root cause, scope, and impact.
Conduct proactive, hypothesis-driven threat hunts to identify advanced attacker activity.
Leverage threat intelligence to enrich investigations and anticipate threat actor tactics, techniques, and procedures (TTPs) targeting the retail industry.

Containment, Eradication, and Recovery

Execute containment, eradication, and recovery actions in coordination with Technology and business teams.
Preserve evidence and maintain chain of custody in support of legal, regulatory, privacy, and cyber insurance requirements.
Translate incident findings into new or improved detections aligned to MITRE ATT&CK.
Partner with Engineering teams to tune monitoring technologies and improve signal-to-noise ratios.

Automation, Playbooks, and Continuous Improvement

Identify opportunities to automate triage, enrichment, and response actions.
Develop, maintain, and test incident response playbooks to keep them current and actionable.
Support tabletop exercises, ransomware preparedness exercises, and cyber crisis simulations.
Lead post-incident reviews and track corrective actions through completion.
Contribute incident data to operational metrics, including Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).

Mentorship and Knowledge Sharing

Mentor and develop junior incident responders through case reviews and hands-on coaching.
Share knowledge through runbooks, training sessions, and lessons learned.

Collaboration and External Coordination

Coordinate with external incident response retainers, forensic vendors, and law enforcement as directed.

Required Experience and Skills

6+ years of experience in cybersecurity, with at least 3 years focused on incident response, digital forensics, or threat hunting.
Proven experience leading investigations of ransomware, business email compromise, cloud, and identity-based attacks.
Hands-on expertise with security technologies including SIEM, SOAR, EDR, cloud security tools, and network and forensic analysis tools.
Working knowledge of Windows, Linux, Active Directory/Entra ID, and major cloud platforms (AWS, Azure, or GCP).
Experience with cybersecurity frameworks including NIST SP 800-61, NIST CSF, and MITRE ATT&CK.
Scripting ability (Python, PowerShell, or similar) to support investigations and automation.
Excellent written and verbal communication skills, including the ability to explain technical findings to non-technical audiences.

Technologies

SIEM
SOAR
EDR
Cloud security tools
Network and forensic analysis tools
Windows
Linux
Active Directory
Entra ID
AWS
Azure
GCP
Python
PowerShell
NIST SP 800-61
NIST CSF
MITRE ATT&CK

Preferred Qualifications

Certifications: GCIH, GCFA, GCFE, GNFA, GREM, CISSP
Experience in large-scale, complex organizations, retail, or highly regulated industries.
Expertise in cybersecurity automation and analytics.

Certifications

GCIH
GCFA
GCFE
GNFA
GREM
CISSP

Benefits

Comprehensive health & wellness benefits (see https://jobs.advanceautoparts.com/us/en/benefits).

Location and Work Availability

Hybrid role based at corporate headquarters in Raleigh, North Carolina (4 days in office, 1 day remote).

View full job page →

Get Ransomware Response Engineer Jobs alerts

New Ransomware Response Engineer Jobs, daily.