Security Incident Response Developer
Core
Build automation and playbooks to scale security incident response, own investigations from triage to closure, and refine SIEM/SOAR platforms.
Role type
mid-level security incident response developer (hands-on IC)
Builds
automated response workflows, playbooks, and detection rules
Domain
cybersecurity / financial services
Required skills
incident response investigation, SIEM query writing and tuning, automation development, cloud infrastructure investigation (AWS/GCP/Azure), stakeholder coordination, threat intelligence analysis
Preferred skills
AI coding tools proficiency, workflow design, cloud security
Technologies
SIEM, SOAR, AWS, GCP, Azure, AI coding tools (Claude Code, Cursor, ChatGPT)
Responsibilities
Own end-to-end investigations (triage, evidence collection, analysis, containment, documentation); build automation to scale response; act as Incident Commander for low/medium severity incidents; refine SIEM/SOAR platforms; develop detection rules based on incident trends
Seniority
Mid-level, hands-on IC
