Security Incident Response Engineer Job Grand Rapids area,Michigan USA,IT/Tech

About Acrisure

A global fintech leader, Acrisure empowers millions of ambitious businesses and individuals with the right solutions to grow boldly forward. Bringing cutting-edge technology and top-tier human support together, we connect clients with customized solutions across a range of insurance, reinsurance, payroll, benefits, cybersecurity, mortgage services – and more.

About Acrisure

In the last twelve years, Acrisure has grown in revenue from $38 million to almost $5 billion and employs over 19,000 colleagues in more than 20 countries. Acrisure was built on entrepreneurial spirit. Prioritizing leadership, accountability, and collaboration, we equip our teams to work at the highest levels possible.

Job Summary

The Security Incident Response Engineer is responsible for detecting, investigating, containing, eradicating, and recovering from cybersecurity incidents across Acrisure's global environment. This role serves as a key member of the Security Operations team and works closely with Infrastructure, Cloud, Identity, Workplace Technology, Legal, Privacy, Human Resources, and business stakeholders to rapidly respond to security threats and reduce organizational risk.

The engineer leverages enterprise security technologies including EDR, SIEM, cloud security platforms, email security solutions, threat intelligence, and security automation tooling to identify and respond to attacks impacting endpoints, identities, cloud environments, applications, and data. This position combines hands‑on incident response, threat hunting, detection tuning, forensic investigation, and continuous improvement activities.

Success in this role means rapidly detecting and containing threats before they become business‑impacting events, continuously improving the organization's ability to respond to attacks, and driving measurable reductions in response times, incident severity, and operational risk.

Incident Response Operations

Investigate and respond to cybersecurity incidents involving endpoints, identities, cloud platforms, email systems, applications, data, and network infrastructure.
Perform incident triage, severity classification, impact analysis, containment, eradication, and recovery activities.
Execute cyber incident response procedures and escalation processes in accordance with the Cyber Incident Response Plan (CIRP).
Coordinate response efforts across Security, Infrastructure, Cloud, IAM, Workplace Technology, Legal, Privacy, Human Resources, and business teams.
Support major incident management activities and provide technical leadership during active security events.
Maintain detailed incident records, timelines, evidence, findings, and lessons learned.

Threat Detection and Investigation

Analyze alerts generated by EDR, SIEM, MDR, email security, cloud security, deception, and threat intelligence platforms.
Validate suspicious activity to distinguish true security incidents from false positives.
Perform root cause analysis to identify attack vectors, affected assets, compromised accounts, and attacker activities.
Conduct proactive threat hunting to identify indicators of compromise, adversary behaviors, and emerging threats.
Leverage MITRE ATT&CK techniques to improve detection and investigative effectiveness.

Digital Forensics and Evidence Collection

Collect, preserve, and analyze system, endpoint, cloud, email, and identity-related evidence.
Perform log analysis, forensic triage, malware investigation, and timeline reconstruction.
Support legal, regulatory, audit, and compliance investigations as required.
Maintain evidence handling and chain‑of‑custody procedures where applicable.

Security Engineering and Continuous Improvement

Develop and maintain incident response playbooks, investigation procedures, and operational runbooks.
Recommend detection improvements,…