Senior Cyber Incident Response Engineer

Required Qualifications

• 5+ years of relevant cybersecurity experience in either incident response, DFIR, detection engineering, threat hunting, and or SOC escalation
• 2+ years of security automation / cyber defense engineering
• Strong proficiency with Python, PowerShell, Bash, or similar scripting languages used for automation and response engineering.
• Ability to lead projects with little guidance, and strong communication
• Knowledge of SIEM, SOAR, EDR, Data Lake, and enterprise security tooling and methodologies.
• Experience handling security incidents and investigating a multitude of cyber threats with various TTPs across multiple enterprise platforms
• Experience building and maintaining API integrations across security and enterprise platforms.
• Working knowledge of SIEM query languages such as SPL, KQL, SQL, or equivalent analytics languages.
• Experience with EDR response actions, investigation workflows, and endpoint containment techniques.
• Experience designing, building, or operating SOAR platforms and automated playbooks.
• Strong understanding of endpoint, identity, network, cloud, email, and SaaS telemetry, including logging, evidence collection, and containment actions across modern environments.
• Experience collecting and using forensic artifacts to support investigations across endpoints, identities, cloud services, email, or SaaS platforms.
• Ability to design for scale, repeatability, automation, reliability, and reduced response time in a production security environment.
• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, Digital Forensics, or a related field, or equivalent practical experience.
• 5+ years of relevant cybersecurity experience in either incident response, DFIR, detection engineering, threat hunting, and or SOC escalation
• 2+ years of security automation / cyber defense engineering
• Strong proficiency with Python, PowerShell, Bash, or similar scripting languages used for automation and response engineering.
• Ability to lead projects with little guidance, and strong communication
• Knowledge of SIEM, SOAR, EDR, Data Lake, and enterprise security tooling and methodologies.
• Experience handling security incidents and investigating a multitude of cyber threats with various TTPs across multiple enterprise platforms
• Experience building and maintaining API integrations across security and enterprise platforms.
• Working knowledge of SIEM query languages such as SPL, KQL, SQL, or equivalent analytics languages.
• Experience with EDR response actions, investigation workflows, and endpoint containment techniques.
• Experience designing, building, or operating SOAR platforms and automated playbooks.
• Strong understanding of endpoint, identity, network, cloud, email, and SaaS telemetry, including logging, evidence collection, and containment actions across modern environments.
• Experience collecting and using forensic artifacts to support investigations across endpoints, identities, cloud services, email, or SaaS platforms.
• Ability to design for scale, repeatability, automation, reliability, and reduced response time in a production security environment.
• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, Digital Forensics, or a related field, or equivalent practical experience.
• Fully Remote: This position has been designated as fully remote, meaning that the position is expected to contribute from a non-NBCUniversal worksite, most commonly an employee’s residence.