Staff Incident Response Engineer

This is a fully remote position, open to applicants in Canada.

📋 Description

• Oversee tools and systems that protect ServiceNow’s production and regulated environments.

• Utilize deductive reasoning to connect seemingly unrelated security events.

• Lead the response to incidents impacting customers and ensure incidents are tracked to resolution across various functional teams.

• Address account-level threats and attacks targeting customer environments.

• Generate post-incident reports, forensic analyses, and remediation strategies.

• Assist with audits, compliance obligations, and regulatory inquiries.

• Develop and sustain incident response playbooks, guidelines, and cybersecurity standards.

• Ensure secure configuration baselines for security tools, workstations, servers, and network devices.

• Analyze vulnerabilities using configuration baseline information.

• Act as an escalation resource and engage in the on-call rotation, including after-hours and weekends.

• Support the deployment, integration, and initial setup of new or enhanced network and systems security solutions.

• Enhance the organization’s overall security posture.

⛳️ Requirements

• Successful completion and maintenance of Government of Canada Reliability Status screening.

• 5 years of verifiable background history, encompassing identity, education, criminal record, and credit checks.

• Generally requires Canadian citizenship or Canadian permanent resident status.

• 6+ years of relevant experience or an equivalent combination of education and experience.

• 7 to 10+ years of relevant experience or a comparable mix of education and experience.

• Experience in integrating AI into work processes, decision-making, or problem-solving.

• Proficient in automation using Python and bash scripting.

• Experience in hardening Linux, Windows, or Mac systems.

• Familiarity with data logging applications such as Splunk.

• Knowledge of vulnerability scanning tools like Qualys and Nessus.

• A defensive security mindset.

• Capability to articulate complex issues to executives and customers.

• Experience in Canadian regulated markets, such as financial services or the public sector, is highly desirable.

• Comprehensive understanding of Security Operations Center and security incident response protocols and procedures.

• Extensive experience in incident response, digital forensics, threat hunting, and threat intelligence.

• Strong networking foundation, including TCP/IP and core protocols.

• Familiarity with SIEM platforms such as Splunk, as well as EDR and SOAR tools.

• Ability to analyze event and system logs, conduct host and memory forensics, including live response, on Windows, macOS, and/or Linux, and investigate malware.

• Experience in drafting internal playbooks, handbooks, and incident response frameworks.

• Understanding of attack vectors, threat tactics, and attacker techniques.

• Knowledge of cloud security principles and experience with AWS, Azure, or GCP.

• Coding or scripting capabilities in one or more general-purpose programming languages.

• Working knowledge of Canadian regulatory requirements for financial services and public sector clients.

• Exceptional written and verbal communication skills, including the ability to explain incidents to executives and customers.

• Readiness to work weekend and after-hours shifts.

• GCIH, GCFA, GCIA, GMON, GSEC, CISSP, or CEH certifications are advantageous.

• Familiarity with the ServiceNow platform is a plus.

🏝️ Benefits

• Equity (when applicable).

• Variable/incentive compensation.

• Health plans, including flexible spending accounts.

• Employee Stock Purchase Plan (ESPP).

• Donation matching.

• Flexible time-off plan.

• Family leave programs.