Incident Responder (42)

Summary

Leading investigations end-to-end, the full-time remote Incident Responder will manage security incidents, conduct threat hunts, and enhance detection capabilities while collaborating with cross-functional teams and external partners.Key responsibilitiesOwn security incidents by validating MSSP escalations, leading investigations, and coordinating response effortsConduct proactive threat hunts across cloud and endpoint telemetry to improve detection coverage and fidelityBuild and tune detection content in Microsoft Sentinel, collaborating closely with the Detection Engineering teamRequired qualificationsProven experience in incident response and security operations in cloud-native environments, particularly with Azure and AWSExperience with Microsoft Sentinel or a comparable SIEM for investigation and detection engineeringExperience managing escalations with an MSSP and providing quality feedback to improve coverageStrong understanding of attacker tactics, techniques, and procedures, including familiarity with the MITRE ATT&CK frameworkCommitment to continuous improvement in operational processes and security tooling

Job Description

Leading investigations end-to-end, the full-time remote Incident Responder will manage security incidents, conduct threat hunts, and enhance detection capabilities while collaborating with cross-functional teams and external partners.Key responsibilitiesOwn security incidents by validating MSSP escalations, leading investigations, and coordinating response effortsConduct proactive threat hunts across cloud and endpoint telemetry to improve detection coverage and fidelityBuild and tune detection content in Microsoft Sentinel, collaborating closely with the Detection Engineering teamRequired qualificationsProven experience in incident response and security operations in cloud-native environments, particularly with Azure and AWSExperience with Microsoft Sentinel or a comparable SIEM for investigation and detection engineeringExperience managing escalations with an MSSP and providing quality feedback to improve coverageStrong understanding of attacker tactics, techniques, and procedures, including familiarity with the MITRE ATT&CK frameworkCommitment to continuous improvement in operational processes and security tooling