Security Engineer, Detection & Response

• Adversary Emulation: Plan and execute red team and purple team exercises, including assumed breach, identity and cloud attack paths, and social engineering scenarios, under approved rules of engagement. Emulate the TTPs of the actors identified through CTI.
• Detection Validation: Work side by side with the SOC and detection engineering to measure whether our controls detect and respond as expected. Map coverage and gaps to MITRE ATT&CK.
• Remediation: Deliver clear findings with prioritized remediation, then retest to confirm gaps are closed.

• Escalation Point: Serve as the senior technical escalation for the SOC, including our managed detection and response partner, on complex or high-severity alerts. Guide triage decisions and make the call on when an alert becomes an incident.
• Detection Improvement: Tune and improve detection content and SOC playbooks based on escalations, incidents, hunts, and exercise results. Reduce false positives and close visibility gaps.
• Mentoring: Raise the technical bar of the SOC through knowledge sharing, documented escalation procedures, and coaching on investigation techniques.

• Collaboration: Work closely with IT, Legal, and other departments to ensure a coordinated and comprehensive response to security threats.
• Must be able to respond to security-related emergencies that may arise outside of regular business hours.
• Participate in security team On-Call rotation.
• Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent experience.
• Minimum of 5 years of experience in information security, with hands-on experience in at least two of the following: incident response, digital forensics, cyber threat intelligence, threat hunting, red team or penetration testing.
• Relevant certifications such as GCIH, GCFA, GCTI, GREM, OSCP, CRTO, or CISSP are highly desirable.
• Working knowledge of MITRE ATT&CK and experience applying it to threat hunting, detection coverage, and adversary emulation.
• Hands-on experience with EDR and SIEM platforms.

with CrowdStrike Falcon, Microsoft Sentinel, and Microsoft Defender XDR is a strong plus.

• Strong understanding of the Microsoft ecosystem, including Windows internals, Active Directory and Entra ID attack paths, Microsoft 365, and Azure.
• Experience with scripting and query languages (PowerShell, Python, KQL) for automation, analysis, and detection development.
• Experience with adversary emulation tooling (for example, Atomic Red Team, MITRE Caldera, or command and control frameworks) and running exercises safely in production environments.
• Excellent problem-solving skills and the ability to work under pressure.
• Meticulous attention to detail to ensure the accuracy and integrity of forensic investigations and incident reports.
• Strong written and verbal communication skills, with the ability to produce intelligence products and incident reports for both technical and executive audiences.
• Ability to work effectively in a team environment and collaborate with cross-functional teams.
• Willingness to stay current with attacker tradecraft, cloud security, and emerging threats such as AI-enabled attacks, and continuously enhance skills.

#LI-JM