Security Incident Response

Security Incident Response Engineer Jobs

2 jobs found

Today

Senior Security Engineer- Security Operations

GE Appliances Louisville, KY

Louisville, KY

Today

Full time Senior Cloud Platforms Cybersecurity Operations

Apply Now

Job Description

GE Appliances is hiring a Senior Security Engineer to lead Security Operations detection and response engineering for enterprise IT and manufacturing environments.

Responsibilities

Act as the senior technical lead and subject-matter expert for security operations, owning detection and response platform architecture, configuration, and operational health; set technical standards used by the MSSP.
Design, build, test, and maintain detection content including correlation rules, behavioral analytics, and IOC/BIOC rules mapped to MITRE ATT&CK; manage the full detection lifecycle using detection-as-code practices (version control, testing, peer review, documentation).
Own telemetry coverage by identifying visibility gaps and onboarding, parsing, and normalizing log sources across endpoints, identity, Microsoft 365, cloud, network, email, DLP, and OT; monitor ingestion health and manage data volume and retention cost.
Engineer security automation and orchestration (SOAR) playbooks and integrations that enrich alerts, automate containment, and connect security tooling with IT service management and collaboration platforms to reduce manual effort and MSSP handling time.
Provide technical oversight of MSSP output in partnership with the Information Security leader owning the MSSP commercial relationship, including:
- Review triage and investigation quality, escalation accuracy, and run-book adherence.
- Drive false-positive reduction and tuning.
- Update MSSP run books and playbooks as detections and the environment change.
Serve as Tier 3 escalation for complex or high-severity incidents escalated by the MSSP; perform hands-on investigation, endpoint and log analysis, scoping, and containment; coordinate with the external incident response retainer when engaged.
Lead hypothesis-driven threat hunting informed by threat intelligence and threats targeting manufacturing; convert hunt outcomes into durable detections and hardening recommendations.
Operationalize threat intelligence by translating advisories, vulnerability disclosures, and adversary reporting into detections, hunts, and blocking actions; track relevant threat actors for GE Appliances.
Validate detection and response effectiveness using purple-team exercises, adversary emulation, and breach-and-attack simulation; measure coverage against MITRE ATT&CK and confirm MSSP detection and response.
Maintain EDR/XDR platform health across endpoint and server estate, including agent coverage, prevention and exploit-protection policies, exclusions governance, and response actions.
Strengthen vulnerability operations run by the MSSP: scan coverage (including authenticated scanning), risk-based prioritization using exploitability and threat intelligence (e.g., CISA KEV, EPSS), correlate vulnerabilities with active threat activity, and automate remediation workflows.
Partner with Cloud, Network, and Identity security engineers to integrate cloud security posture (CNAPP), network, and identity signals into detection and response, including identity threat detection for account takeover, MFA fatigue, and AiTM phishing.
Partner with OT Security to extend monitoring and detection into manufacturing environments safely for production and consistent with ISA/IEC 62443 and NIST SP 800-82.
Author and maintain incident response playbooks and technical run books; lead the technical portion of post-incident reviews and drive corrective actions to closure.
Define, automate, and report operational metrics and KPIs (e.g., MTTD, MTTR, ATT&CK detection coverage, false-positive rate, log source health, MSSP escalation quality) to the CISO and Information Security leadership.
Contribute to the security operations roadmap by evaluating emerging capabilities (including AI-assisted triage and agentic SOC automation) and supporting platform evaluations, proofs of concept, and TCO analyses.
Provide technical evidence for logging, monitoring, and incident response controls in SOX, C-SOX, PCI-DSS, and other audits; drive remediation of related findings.
Mentor engineers and transfer knowledge to MSSP analysts on the GE Appliances environment, detections, and response procedures.

Requirements

Bachelor’s degree in Information Systems, Cybersecurity, Computer Science, or related technical field, or equivalent practical experience.
6–10 years progressive experience in IT or information security, including 4+ years hands-on experience in security operations, detection engineering, or incident response in a large enterprise environment.
Deep hands-on experience engineering and administering SIEM/SOAR and EDR/XDR platforms (e.g., Palo Alto Networks Cortex XSIAM/XDR, Splunk, Microsoft Sentinel/Defender, CrowdStrike), including writing detection rules/queries (e.g., XQL, SPL, KQL).
Proven experience building detection content mapped to MITRE ATT&CK and tuning it for fidelity at enterprise scale.
Experience building SOAR playbooks and integrations; proficiency in Python and/or PowerShell; working with REST APIs and JSON.
Hands-on incident response experience with significant enterprise incidents such as ransomware, BEC, and account takeover, including endpoint, log, and network analysis.
Experience in a technical oversight role working with an MSSP/MDR, including tuning, escalation quality review, and run-book development.
Strong understanding of log sources and telemetry across Windows, Linux, network, cloud (AWS, Azure, and/or GCP), Microsoft 365, and identity providers.
Working knowledge of MITRE ATT&CK, NIST SP 800-61, NIST CSF, and CIS Controls.
Excellent verbal and written communication skills with the ability to communicate with technical and executive audiences.

Technologies

Palo Alto Networks Cortex XSIAM/XDR, Splunk, Microsoft Sentinel/Defender, CrowdStrike
XQL, SPL, KQL
Python, PowerShell, REST APIs, JSON
MITRE ATT&CK, SOAR, SIEM, EDR, XDR
Microsoft 365, CNAPP
CISA KEV, EPSS
ISA/IEC 62443, NIST SP 800-82, NIST SP 800-61, NIST CSF, CIS Controls
SOX, C-SOX, PCI-DSS
Detection-as-code, Git, Sigma, Atomic Red Team, MITRE Caldera

Preferred qualifications

Certifications: GIAC (GCIH, GCIA, GCDA, GCFA, GCTI), Palo Alto Networks Cortex certifications, CISSP, or similar.
Experience with detection-as-code practices, Git, CI/CD pipelines, and vendor-neutral rule formats such as Sigma.
Experience with threat hunting, purple teaming, and adversary emulation tools (Atomic Red Team, MITRE Caldera, breach-and-attack simulation platforms).
Familiarity with OT/ICS monitoring frameworks such as ISA/IEC 62443 or NIST SP 800-82.
Experience integrating cloud security (CNAPP/CSPM) and identity telemetry into detection and response.
Experience applying AI and large language models to security operations; familiarity with AI security frameworks such as MITRE ATLAS and the OWASP Top 10 for LLM Applications.
Experience in manufacturing, critical infrastructure, or global multinational organizations.

Working conditions

Normal office environment.
Occasional weekend and/or evening work; after-hours escalation for major security incidents and participation in an on-call rotation.

Location

Louisville, KY (onsite), USA

View full job page →

Today

Cybersecurity Engineer

Nodak Insurance Company Fargo, ND

Fargo, ND

Today

$94k - $125k/yr Full time Cyber Security Cybersecurity Operations Cybersecurity Tools

Apply Now

Job Description

Cybersecurity Engineer role focused on designing, building, and improving security controls to protect organizational information assets.

Responsibilities

Design, build, and deploy cybersecurity infrastructure and controls, including firewalls, IDS/IPS, SIEM, endpoint detection and response, email security, and identity protection
Evaluate and select new security technologies; define configuration standards and deliver reference designs used by security operations
Lead investigation, containment, and resolution of security incidents
Build and tune detection content, correlation rules, and automated response actions
Develop and maintain the Incident Response Plan; run periodic tabletop exercises and drills
Produce post-incident reports with assigned corrective actions
Own the vulnerability management program, including scan coverage, risk-based prioritization, and remediation standards
Coordinate third-party penetration tests and validate remediation outcomes
Perform threat modeling and security design reviews for new systems and significant changes
Conduct security design reviews for AI services, models, agents, and integrations
Define and implement data protection controls for enterprise AI, including data loss prevention, tenant boundaries, and logging
Support the AI governance program with technical assessments and control recommendations
Build automation and integrations to reduce manual security effort, including scripting, API integrations between security platforms, and configuration as code where applicable
Lead medium to large projects to improve overall cybersecurity posture, defining scope, sequence, and coordinating delivery across technical teams
Prioritize projects based on impact and cost assessment
Translate regulatory requirements into technical control designs, including GLBA Safeguards Rule, NAIC Insurance Data Security Model Law, PCI-DSS, and applicable state regulations
Support internal and external security audits and collaborate with internal teams on compliance and audit-related activities
Build and maintain security architecture documentation, configuration standards, and engineering runbooks
Provide technical direction to security operations staff and act as the escalation point for complex security issues

Requirements

Working knowledge of common security frameworks with ability to translate them into technical controls (e.g., NIST CSF 2.0, NIST SP 800-53, ISO 27001, CIS Controls)
Deep understanding across enterprise security domains: identity and access management, endpoint detection and response, email and collaboration security, data protection, network security, and secure application delivery
Experience architecting and administering Microsoft 365 and Microsoft Entra ID, including Conditional Access, Microsoft Defender XDR, Intune, and Purview
Experience building and tuning detection content in SIEM or XDR platforms, including writing queries and correlation logic
Proficiency with scripting and automation (e.g., PowerShell, Python) and integrating security platforms via APIs
Sound judgment under pressure, including directing containment decisions during an active security incident
Strong written and verbal communication skills for technical and non-technical audiences
Experience securing and administering enterprise generative AI solutions such as Microsoft Copilot and Google Gemini

Technologies

NIST CSF 2.0, NIST SP 800-53, ISO 27001, CIS Controls
Microsoft 365, Microsoft Entra ID, Conditional Access, Microsoft Defender XDR, Intune, Purview
SIEM, XDR
PowerShell, Python, APIs
Microsoft Copilot, Google Gemini
Firewalls, intrusion detection/prevention systems (IDS/IPS)
Endpoint detection and response, email security, identity protection
Data loss prevention, tenant boundaries, logging, configuration as code
GLBA Safeguards Rule, NAIC Insurance Data Security Model Law, PCI-DSS
Microsoft Certified: Cybersecurity Architect (SC-100)

Education, Work Experience, and Certifications

Experience: 7+ years
Education: Bachelor’s degree or higher-level in Cybersecurity, Computer Science, IT Management, or other relevant area (or equivalent)
Certifications: CISSP
Certifications: Microsoft Certified: Cybersecurity Architect (SC-100)
Certifications: GIAC Certified Incident Handler (GCIH) or GIAC Certified Intrusion Analyst (GCIA)
Certifications: Relevant vendor-specific certifications (e.g., Palo Alto Networks, Microsoft Azure Security)

Travel Requirements

Light travel by car or air, including overnight

Physical Demands / Working Conditions

Ability to handle typical office work including sitting, standing, and typing indoors; tasks may occur in close proximity to other people
Ability to exert up to 10 pounds of force occasionally to move objects
Close visual acuity for preparing and analyzing data and figures, viewing a computer screen, visual inspection, assembly of parts, and extensive reading
Flexible work schedule to meet business needs, including being on call 24x7 and being on-site during specified or core hours
Ability to operate standard computer hardware

Location: Fargo, ND (onsite)

Salary: USD 93,798 - 125,064 per year

View full job page →

Security Incident Response Engineer Jobs

Senior Security Engineer- Security Operations

Cybersecurity Engineer

Get Security Incident Response Engineer Jobs alerts