Security Investigations

Security Investigations Engineer Jobs

3 jobs found

22d ago

Alert, Detection, and Response Engineer, Associate

Blackstone Group Miami, FL

Miami, FL

22d ago

$110k - $170k/yr Full time Ai Security Cloud Threat Detection Crowdstrike

Apply Now

Job Description

Blackstone’s front-line cyber defense team is seeking an associate incident responder to detect, investigate, and respond to information security incidents across multiple domains.

Responsibilities

Manage an incident queue from intake through investigation, containment, and closure across email, endpoint, identity, network, and cloud
Handle Tier 1 escalations by taking ownership of more complex investigations and bringing in additional responders as scope expands
Investigate incidents in the firm’s SIEM, writing and refining searches to pivot across endpoint, authentication, email, network, and cloud telemetry
Perform endpoint investigation, host containment, and live response in the EDR platform, including process lineage, persistence review, and artifact collection
Investigate email threats end to end (phishing, business email compromise, malicious attachments and links) using header and message trace analysis to identify targeted users and drive mailbox remediation
Investigate cloud and identity compromise, including credential misuse, role and privilege abuse, session hijacking, and multi-factor bypass
Investigate third-party and SaaS provider compromises by coordinating with the provider’s incident response team to confirm containment and determine what Blackstone data was affected
Independently scope exposure by hunting provider indicators across endpoint, email, network, and cloud telemetry; coordinate findings and remediation with legal and compliance, vendor risk, and business owners
Serve as a core incident response team member by scoping intrusions, driving containment and eradication, briefing stakeholders, and escalating using the firm’s severity model
Author and tune detections based on investigation findings, validating logic against historical and live data, moving detections through review into production, and confirming real-world firing without unacceptable noise
Collaborate with agentic AI investigation tooling for first-pass triage and enrichment, evaluate outputs, escalate inaccuracies, and feed corrections back to improve coverage
Help expand detection and response coverage for the firm’s increasing use of AI across a fast-moving attack surface
Turn investigation findings into durable coverage by reducing false positives and building automation to remove repetitive triage, enrichment, and response steps
Mentor Tier 1 analysts on investigation technique through case reviews and hands-on coaching
Document investigations and incidents with audit-ready evidence handling and chain of custody; communicate clearly to technical teams and senior stakeholders
Contribute to threat hunts and purple team exercises using red team activity and threat intelligence to identify gaps
Participate in incident response and SOC on-call rotation (occasional, roughly quarterly) to respond to escalated security incidents

Requirements

2+ years of hands-on experience in security operations, incident response, or a comparable technical security role
Proven ability to run security investigations end to end from alert through root cause and containment in a SOC or IR environment
Hands-on SIEM experience, including writing and troubleshooting queries; experience with a major enterprise SIEM and native query language (Splunk/SPL, Microsoft Sentinel/KQL, or Elastic)
Hands-on EDR experience for endpoint investigation and containment; experience with a leading EDR platform (CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint)
Working knowledge of cloud and identity investigation, including cloud audit logging, IAM, SSO, and identity providers such as Okta or Microsoft Entra ID
Practical understanding of attacker behavior across the intrusion lifecycle, including phishing and business email compromise, credential theft, privilege escalation, lateral movement, persistence, and exfiltration
Familiarity with security tools involved in investigations: email security, endpoint protection, proxies and firewalls, DLP, and vulnerability data
Working knowledge of MITRE ATT&CK and experience mapping observed activity to techniques
Experience scripting in Python and/or PowerShell for enrichment, parsing, and automation of repetitive analysis
Demonstrated hands-on use of AI tooling in real work, including the ability to explain projects in detail and exercise judgment about when outputs cannot be trusted
Clear technical writing to explain incident impact to engineers and non-technical stakeholders
Ability to self-organize, prioritize during time pressure, and remain accurate during live incidents

Technologies

SIEM (Splunk/SPL, Microsoft Sentinel/KQL, Elastic)
EDR (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint)
Okta, Microsoft Entra ID
MITRE ATT&CK
Python, PowerShell
AI tools, agentic AI investigation tooling
Email security, DLP, MFA bypass
SIEM queries, SIEM correlation searches

Benefits

Comprehensive health benefits including medical, dental, vision, and FSA
Paid time off
Life insurance
401(k) plan
Discretionary bonuses
Certain employees may be eligible for equity and other incentive compensation at Blackstone’s sole discretion

Preferred Qualifications

Detection engineering experience authoring or tuning SIEM correlation searches, EDR custom rules, or Sigma content, and validating whether detections work
Detection-as-code experience with Git-based workflows, peer review, and CI validation of detection content
SOAR automation experience (Torq, Splunk SOAR, Tines, or similar)
Digital forensics capability (memory, disk, or network analysis) or hands-on malware triage and sandboxing
Experience with agentic AI or LLM-assisted security tooling and AI security monitoring platforms
Threat hunting experience with hypothesis-driven hunts against endpoint or cloud telemetry
Working knowledge of at least one major cloud platform (AWS, Azure, or GCP), including investigation use of logging, identity, and access services
Experience in financial services or another heavily regulated, globally distributed environment
At least one active security certification such as Security+, GCIH, GCFA, GCIA, GCED, CySA+, or a vendor SIEM certification
B.S. in Computer Science, Cybersecurity, Information Systems, or related technical field

Location: Miami, FL (onsite)

Salary: USD 110,000 - 170,000 per year

Expected annual base salary range: $110,000 - $170,000

View full job page →

1mo ago

Senior Security Engineer - Digital Forensics and Incident Response (DFIR)

Intuit Frisco, TX

Frisco, TX

1mo ago Closed

Full time Agent Ai Security Cloud Platforms

This position is no longer accepting applications (closed Oct 18, 2026).

Job Description

Intuit’s Digital Forensics and Incident Response (DFIR) team within the Security Operations Center (SOC) is hiring a Senior Security Engineer to drive investigations, detection improvements, and emerging AI/agentic risk response.

Responsibilities

Oversee and promptly respond to escalated security events or investigations; activate the Security Incident Response Plan when required.
Provide on-call support for critical severity issues, coordinate communications, and report incident status to the appropriate stakeholders.
Lead forensic analysis to determine root cause, scope, and impact of security incidents.
Investigate and respond to incidents involving AI/LLM-based tools and agentic platforms, including data leakage, insecure output handling, and unauthorized model access.
Extend incident response playbooks to cover generative AI and AI SOC platform risks.
Develop, maintain, and improve incident response plans, procedures, and playbooks to enable swift action and support regulatory compliance.
Use AI SOC platforms and frontier AI tools to accelerate triage, detection tuning, investigation, and documentation, and evaluate new AI capabilities during onboarding.
Provide guidance and training on security best practices and incident response to organizational partners, aligned with business objectives and compliance requirements.
Mentor and train incident responders on incident handling, forensic analysis, and cloud security forensics best practices.
Collaborate with Compliance, Legal, and Risk teams to integrate incident response operations with business and regulatory needs.
Assess vulnerabilities, propose remediation strategies, and stay current on emerging security trends, threats, and countermeasures.

Requirements

3-5 years of experience in a dedicated cybersecurity role with strong emphasis on digital forensics and incident response.
Bachelor’s degree or higher in Technology, Computer Science, Cybersecurity, or related field, or equivalent hands-on experience (preferred).
1-3 years writing scripts or code in Bash, PowerShell, or Python to automate security work.
Comfort using AI coding assistants and AI SOC platforms to build faster, with awareness of risks introduced by AI-generated code.
Working knowledge of AI/LLM security risks and mitigations, including data exfiltration, insecure output handling, model and data supply chain risk, and shadow AI usage.
Familiarity with frameworks such as OWASP Top 10 for LLM Applications, MITRE ATLAS, and NIST AI RMF.
Experience performing analysis and detection engineering using Endpoint Detection and Response or Cloud Security Posture Management tools such as CrowdStrike Falcon and Wiz.
Proven threat hunting experience using hypothesis-driven hunts across endpoint, cloud, and network telemetry to uncover threats that evade existing detections.
Comprehensive understanding of cybersecurity, networking, and cloud fundamentals, including frameworks such as OWASP, MITRE ATT&CK, NIST, and CIS.
Experience using and defending public cloud services: AWS, Azure, and GCP (IAM, CI/CD Pipelines, Network Security, DLP).
Deep understanding of SIEM solutions such as Splunk and LogScale.
Strong analytical and problem-solving skills focused on root cause identification and assessing risk exposure.
Exceptional communication skills (verbal and written) to explain technical details to non-technical audiences and support stakeholder relationships.
Self-motivated and able to work autonomously, managing tasks effectively and seeking assistance when necessary.
Ability to work under pressure in a dynamic environment, prioritizing tasks to meet tight deadlines while maintaining procedural discipline.
Proficiency in digital forensics technologies and methodologies, and expertise in the Security Incident Response Lifecycle based on frameworks like NIST or SANS.
Adaptable and proactive approach with willingness to take on varied responsibilities and continuously learn.
Industry-recognized certifications (advantageous), such as AWS Security Specialty, GCIH, GCFA, GFCE, CISSP, or emerging AI security credentials.

Technologies

Bash
PowerShell
Python
AWS Security Specialty
GCIH
GCFA
GFCE
CISSP
AWS
Azure
GCP
IAM
CI/CD Pipelines
Network Security
DLP
CrowdStrike Falcon
Wiz
Splunk
LogScale
Security Information and Event Management (SIEM)
Endpoint Detection and Response
Cloud Security Posture Management
OWASP Top 10 for LLM Applications
MITRE ATLAS
NIST AI RMF
OWASP
MITRE ATT&CK
NIST
CIS
SANS
AI coding assistants
AI SOC platforms
frontier AI tools

Location

Frisco, TX (onsite)

Compensation and Benefits

May be eligible for a cash bonus, equity rewards, and benefits in accordance with applicable plans and programs.

View full job page →

1mo ago

Security Engineer III, Exploitation Analyst / Incident Responder

Deloitte Baltimore, MD

Baltimore, MD

1mo ago Closed

$103k - $189k/yr Full time Cyber Forensics Cyber Investigation Cyber Investigations

This position is no longer accepting applications (closed Sep 24, 2026).

Job Description

Deloitte’s Cyber Defense & Resilience team helps clients defend against advanced threats by strengthening security operations, monitoring technology, data analytics, and threat intelligence. You’ll support efforts to manage and protect dynamic attack surfaces, and help enable rapid crisis and cyber incident response so clients can be ready for, respond to, and recover from business disruptions.

What you’ll do

As a Cyber Exploitation Analyst and Incident Responder, you will analyze threat activity and investigate incidents across enterprise environments. You’ll monitor networks, systems, and applications for indicators of compromise and use threat data to identify malicious activity and patterns.

Monitor networks, systems, and applications for indicators of compromise and analyze threat data to identify malicious activity.
Investigate security incidents by collecting and analyzing logs and artifacts, including memory and network traffic; support containment, eradication, and recovery activities.
Identify and assess vulnerabilities across systems, networks, and applications, then recommend remediation actions based on risk and exploitability.
Analyze malware, exploits, and adversary tools, including reverse engineering malicious code and simulating adversary techniques in controlled environments.
Produce technical reports, briefings, and documentation that summarize findings, methodologies, and recommendations for stakeholders.

Skills and qualifications

Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical field.
Active Top-Secret Clearance.
2+ years of experience in cyber exploitation analysis, threat intelligence, or incident response.
Experience analyzing advanced persistent threats (APTs), malware, exploitation techniques, and reverse engineering tools such as IDA Pro or Ghidra.
Experience performing vulnerability assessments, penetration testing, or red team activities.
Hands-on experience with network traffic analysis, log analysis, and digital forensics, including Windows, Linux, and macOS, common network protocols, and scripting languages such as Python, PowerShell, or Bash.
Experience with security monitoring tools such as SIEM, IDS, IPS, and EDR.
Ability to travel up to 20% on average based on work, clients, and industries/sectors served.
Ability to work at client onsite or a Deloitte office for up to 5 days a week.
Must have industry certifications such as GIAC, CISSP, or CompTIA Security+ (required).
Must be legally authorized to work in the United States without employer sponsorship, now or in the future.

Preferred qualifications

Experience supporting incident response in government, defense, intelligence, or large enterprise environments.
Experience analyzing packet captures, memory dumps, and host-based forensic artifacts.
Experience mapping threat activity to the MITRE ATT&CK framework.
Experience developing or tuning detections for SIEM or EDR platforms.
Industry certifications such as GIAC, CISSP, or CompTIA Security+.

Technologies you may work with

IDA Pro, Ghidra, Python, PowerShell, Bash
SIEM, IDS, IPS, EDR
Windows, Linux, macOS
MITRE ATT&CK, Global Information Assurance Certification (GIAC), Certified Information Systems Security Professional (CISSP), CompTIA Security+

Location: Baltimore, MD (onsite)
Compensation: USD 102,500 - 188,900 per year

View full job page →

Security Investigations Engineer Jobs

Alert, Detection, and Response Engineer, Associate

Senior Security Engineer - Digital Forensics and Incident Response (DFIR)

Security Engineer III, Exploitation Analyst / Incident Responder

Get Security Investigations Engineer Jobs alerts