Detection, and Response Engineer, Associate

Blackstone is hiring an Alert, Detection, and Response Associate for onsite incident response and detection engineering work in Miami, FL.

• Manage an incident queue from intake through investigation, containment, and closure across domains including email, endpoint, identity, network, and cloud
• Own Tier 1 escalations by taking over complex investigations and bringing in additional responders as scope expands
• Investigate security activity in the firm’s SIEM, writing and refining searches to pivot across endpoint, authentication, email, network, and cloud telemetry
• Perform endpoint investigation and live response in the firm’s EDR, including process lineage review, persistence assessment, and artifact collection
• Investigate email threats end to end, covering phishing, business email compromise, and malicious attachments and links
• Use header and message trace analysis to determine who was targeted and drive remediation across impacted mailboxes
• Investigate cloud and identity compromise, including credential misuse, role and privilege abuse, session hijacking, and multi-factor bypass
• Scope suspected third-party and SaaS provider compromises by coordinating with the provider’s incident response team to confirm containment and affected Blackstone data
• Independently hunt for provider indicators across endpoint, email, network, and cloud telemetry, coordinating findings and remediation with legal and compliance, vendor risk, and business owners
• Serve as a core incident response team member: scope intrusions, drive containment and eradication, brief stakeholders, and upscale per the severity model
• Turn investigation outcomes into detections by authoring and tuning detection logic, validating against historical and live data, moving through review into production, and confirming acceptable signal quality
• Collaborate with agentic AI investigation tooling during first-pass triage and enrichment by evaluating outputs, escalating incorrect conclusions, and feeding back corrections to improve coverage
• Help expand detection and response coverage as the firm increases use of AI across a fast-moving attack surface
• Convert repeatable investigation and response work into durable automation to reduce repetitive steps and reduce false positives
• Mentor Tier 1 analysts on investigation technique via case reviews and hands-on coaching
• Document investigations and incidents with evidence handling and chain of custody practices, communicating clearly to technical teams and senior stakeholders
• Contribute to threat hunts and purple team exercises, using red team activity and threat intelligence to identify gaps
• Participate in incident response and SOC on-call rotation (occasional, roughly quarterly) to respond to escalated security incidents

• 2+ years of hands-on experience in security operations, incident response, or a comparable technical security role
• Proven ability to run end-to-end security investigations from alert through root cause, containment, and resolution in a SOC or incident response environment
• Hands-on SIEM experience, including writing and troubleshooting queries; experience with a major enterprise SIEM and native query language (Splunk/SPL, Microsoft Sentinel/KQL, or Elastic)
• Hands-on EDR experience performing endpoint investigation and containment using a leading EDR platform (Crowd Strike, Sentinel One, or Microsoft Defender for Endpoint)
• Working knowledge of cloud and identity investigation, including cloud audit logging, IAM, and SSO, plus identity providers such as Okta or Microsoft Entra
• Practical understanding of attacker behavior across the intrusion lifecycle: phishing and business email compromise, credential theft, privilege escalation, lateral movement, persistence, and exfiltration
• Familiarity with security technologies used in investigations, including email security, endpoint protection, proxies and firewalls, DLP, and vulnerability data
• Working knowledge of MITRE ATT&CK and experience mapping observed activity to techniques
• Experience scripting in Python and/or Power Shell for enrichment, parsing, and automating repetitive analysis
• Hands-on experience using AI tooling in real work, with detailed examples and the judgment to identify untrustworthy outputs
• Clear technical writing skills for explaining incidents and impact to both engineers and non-technical stakeholders
• Ability to self-organize, prioritize under time pressure, and maintain accuracy during live incidents

• SIEM:
  Splunk/SPL, Microsoft…