IT - Incident Response Engineer

Job Summary

Eaton’s Corporate Sector division is currently seeking an IT Incident Response Engineer. The expected annual salary range for this role is $113,000 - $165,000 a year.

Identify, analyze, and respond to advanced cyber threats and incidents across on‑premises, hybrid, and multi‑cloud environments. Serve as a senior member of Eaton’s Cyber Security Incident Response Team (CSIRT), applying deep incident response and cloud security expertise while advancing next‑generation capabilities in agentic AI, automation, detection engineering, and insider threat program.

• Engineers, maintains, and continuously improves detection and response capabilities across cloud and on‑premises estates.
• Investigates, analyzes, contains, and remediates cyber threats and security incidents that could impact the organization.
• Builds automation and AI‑enabled tooling that scales the Security Operations Center (SOC).
• Provides 24/7/365 on‑call cyber security incident response, focusing on containing, remediating, and recovering from incidents.
• Responds to, investigates, and resolves information security issues in accordance with compliance, regulatory, and investigative standards.
• Manages and coordinates response to malicious cyber activity targeting Eaton’s assets, including IT, cloud, and operational technology (OT) environments.
• Performs proactive threat hunting based on emerging indicators of compromise, vulnerabilities, and threat intelligence.
• Leads detection, investigation, and response for cloud security incidents across major platforms (Microsoft Azure, AWS, and/or Google Cloud).
• Develops and tunes cloud‑native detections using cloud logging and telemetry.
• Applies knowledge of cloud identity and access management, misconfigurations, and attack paths to strengthen detection coverage and reduce exposure.
• Partners with cloud platform and engineering teams to embed security into cloud architecture and support Cloud Security Posture Management (CSPM) initiatives.
• Tracks threat actors and campaigns relevant to Eaton’s industry and geography; enriches incidents with contextual intelligence.
• Designs, builds, and enables agentic AI and automation workflows (SOAR, scripting, AI agents) to accelerate triage, investigation, containment, and reporting.
• Develops and maintains automated playbooks that reduce mean time to detect and respond.
• Contributes to securing Eaton’s adoption of AI—assessing AI/LLM systems and agents for security risk.
• Conducts digital forensic analysis and eDiscovery in support of incident response, internal investigations, and legal/compliance requests.
• Provides security engineering services, including deployment, configuration, management, and updating of the security tool stack.
• Develops advanced queries, correlation rules, and detections to enhance the organization’s detection coverage and security posture.
• Contributes to SIEM architecture—including cloud log onboarding, normalization, content lifecycle, and tuning.

Basic (required):

• Bachelor’s Degree from an accredited institution.
• Minimum seven (7) years in security operations, incident response, cloud security, e‑Discovery, insider threat, security engineering or related field.
• No relocation is offered for this position; candidates must currently reside within 50 miles of Beachwood, OH.
• Must be a U.S. person as defined by ITAR and legally authorized to work in the United States without sponsorship.

Preferred:

• Hands‑on experience leading or performing cyber security incident response, including containment, remediation, and recovery.
• Hands‑on cloud security experience with one or more major platforms.
• Experience correlating events from multiple sources to detect suspicious or malicious activity.
• Detection engineering experience and SIEM content development and architecture.
• Experience building automation and/or agentic AI workflows (SOAR, scripting in Python/Power Shell).
• Working knowledge of AI/LLM security concepts and associated risks.
• Experience with digital forensics and eDiscovery tools and methodologies.
• Solid understanding of adversary TTPs and the MITRE ATT&CK framework.
• Capacity to comprehend complex technical infrastructure,…