Principal Incident Response Engineer

This is a fully remote position, open to applicants in Missouri.

📋 Description

• Oversee enterprise incident response and cyber crisis management from the detection phase to recovery.

• Lead investigations involving hosts, networks, cloud environments, identity, and SaaS across Windows, Linux, macOS, Microsoft 365, AWS, Azure, and hybrid setups.

• Conduct advanced threat hunting and compromise assessments utilizing SIEM, EDR, forensic, and threat intelligence platforms.

• Formulate containment, eradication, and remediation strategies that align with business risks.

• Create executive briefings, technical documentation, board-ready updates, and post-incident evaluations.

• Collaborate with legal, compliance, privacy, auditing, and external parties as necessary.

• Propel the adoption of AI-enhanced workflows to enhance investigation speed, reporting quality, and operational efficiency.

• Participate in the 24/7 on-call rotation.

• Offer technical leadership throughout investigations and impact strategic security decisions.

• Aid in the development of security capabilities and readiness for cybersecurity risk management.

• Execute measurable projects that span across the organization.

• Enable global Security Operations through operational support, development, and engineering.

⛳️ Requirements

• A Master’s degree in Arts/Sciences (MA/MS) or equivalent experience is required.

• Minimum of 8 years in incident response, DFIR, security operations, consulting, or a related cybersecurity field is required.

• Preferred experience of 10+ years in a relevant role.

• Proven ability to lead complex incidents and adapt strategies based on emerging information.

• Experience managing significant cyber incidents, including ransomware, business email compromise, insider threats, cloud breaches, supply chain attacks, or advanced persistent threats.

• Strong digital forensics skills with proficiency in industry-standard forensic and triage tools.

• Familiarity with Splunk, Microsoft Defender, CrowdStrike Falcon, ServiceNow SIR, and cloud security technologies.

• Understanding of network protocols, detection engineering, log analytics, and threat hunting methodologies.

• Excellent verbal and written communication abilities for both technical and executive audiences.

• Capability to manage multiple priorities within a global enterprise context.

• Experience with forensic tools such as FTK, EnCase, X-Ways, Magnet AXIOM, and SIFT.

• Strong analytical, investigative, and problem-solving skills.

• Ability to adapt to new approaches and perform under tight deadlines and high-pressure situations.

• Proficient in juggling multiple tasks, clients, and projects at once.

• Skill in balancing priorities, deadlines, and deliverables.

• Capability to translate business needs and challenges into effective solutions.

• Knowledge of Windows, macOS, and Linux internals.

• Experience with scripting languages such as PowerShell, Python, JavaScript, or TypeScript.

• Familiarity with AWS, Microsoft 365, Microsoft domain environments, IAM/AAA technologies, Active Directory, Okta, OpenID, SAML, OAuth, JWT, networking, SIEM, EDR, threat intelligence platforms, email security, and DNS security.

• Contributions at the industry level are preferred.

• Professional industry certification is preferred.

🏝️ Benefits

• Annual bonus plan.

• Potential eligibility for long-term equity incentive plans for qualifying positions.

• Comprehensive health benefits.

• Retirement benefits.

• Additional employee benefits.

• Opportunities to gain knowledge and experience with diverse colleagues globally.

• A respectful and welcoming work environment.

• Career advancement potential.

• AI-supported personalized job recommendations, interview scheduling, and chatbot assistance during preliminary screening.