Staff Incident Response Engineer
Core
Monitor and respond to security incidents, threats, and attacks in production environments; lead incident response, forensics, and remediation for customer and internal systems.
Role type
Staff Incident Response Engineer
Builds
Incident response playbooks, forensic reports, remediation plans, and secure configuration baselines
Domain
Cybersecurity / Security Operations Center (SOC)
Required skills
Incident response, digital forensics, threat hunting, threat intelligence, SIEM (Splunk), EDR, SOAR, vulnerability scanning, Linux/Windows/Mac hardening, Python/bash scripting, cloud security (AWS/Azure/GCP), TCP/IP networking
Preferred skills
GCIH, GCFA, GCIA, GMON, GSEC, CISSP, CEH certifications, ServiceNow platform knowledge, experience in Canadian regulated markets (financial services/public sector)
Technologies
Splunk, Qualys, Nessus, AWS, Azure, GCP, Python, bash
Responsibilities
Monitor tools and systems defending production environments; lead response to incidents affecting customers; respond to account-level threats and attacks; produce post-incident and forensic reports; maintain secure configuration baselines and analyze vulnerabilities; serve as escalation point for on-call rotation; assist with deployment and configuration of new security solutions
Seniority
Staff, hands-on IC with strategic oversight
