Senior Security Engineer - Digital Forensics and Incident Response; DFIR

Overview

We are seeking an experienced Senior Security Engineer to join our Digital Forensics and Incident Response (DFIR) team within the broader Security Operations Center (SOC), to help our organization respond to cyber-attacks. The ideal candidate will have a deep understanding of the security incident response and incident management process, attacker kill chains / methodologies, be able to respond quickly to attacks, restore services, and forensically investigate the root cause.

They will also help defend against emerging AI and agentic system risks, tune detections, and build out threat hunting capabilities. As a member of our SOC, you will closely collaborate with other engineers to design and implement solutions, improve incident response readiness, and provide guidance and training to external teams.

We are seeking an experienced Senior Security Engineer to join our Digital Forensics and Incident Response (DFIR) team within the broader Security Operations Center (SOC), to help our organization respond to cyber-attacks. The ideal candidate will have a deep understanding of the security incident response and incident management process, attacker kill chains / methodologies, be able to respond quickly to attacks, restore services, and forensically investigate the root cause.

They will also help defend against emerging AI and agentic system risks, tune detections, and build out threat hunting capabilities. As a member of our SOC, you will closely collaborate with other engineers to design and implement solutions, improve incident response readiness, and provide guidance and training to external teams.

• Oversee and promptly respond to escalated security events or investigations, and activate the Security Incident Response Plan as required.
• Provide on-call support for critical severity issues, manage communications, and report incident status to the appropriate stakeholders.
• Lead forensic analysis and conduct investigations to ascertain the root cause, scope, and impact of security incidents.
• Investigate and respond to incidents involving AI/LLM-based tools and agentic platforms, such as data leakage, insecure output handling, and unauthorized model access, and extend IR playbooks to cover generative AI and AI SOC platform risks.
• Develop, maintain, and improve incident response plans, procedures, and playbooks to ensure swift action and regulatory compliance.
• Leverage AI SOC platforms and frontier AI tools to accelerate triage, detection tuning, investigation, and documentation, and help evaluate new AI capabilities as they are onboarded.
• Present guidance and training on security best practices and incident response to organizational partners, while ensuring alignment with business objectives and compliance requirements.
• Mentor and train incident responders on incident handling techniques, forensic analysis, and cloud security forensics and best practices.
• Collaborate with Compliance, Legal, and Risk teams to integrate incident response operations with business and regulatory needs.
• Assess vulnerabilities, propose remediation strategies, and keep up-to-date on current and emerging security trends, threats, and countermeasures.

• A Bachelor's degree or higher in Technology, Computer Science, Cybersecurity, or a related field, or equivalent hands‑on experience, is preferred.
• Possession of industry‑recognized professional certifications such as AWS Security Specialty, GCIH, GCFA, GFCE, CISSP, or emerging AI security credentials is advantageous.
• 3-5 years of experience in a dedicated cybersecurity role, with a strong emphasis on digital forensics and incident response.
• 1-3 years writing scripts or code (Bash, Power Shell, Python) to automate security work,…