SOC/Incident Response Engineer Job Cleveland Ohio USA,IT/Tech

Who We Are

At Benesch we pride ourselves on exceeding expectations and building trust not only with our clients but with our employees—Benesch's #1 asset. Committed to providing not only the highest level of legal service to our clients, Benesch also aspires to create a positive work environment for our employees. Our Firm continues to earn placement on Chicago and Cleveland's Top Workplaces list, along with Cleveland's North Coast 99 Top Workplaces rankings.

We also continue to advance on the AmLaw 125 list, placing us among the top 125 law firms in the country.

Benesch is proud to be recognized for being a firm that attracts and retains top talent—a great place to work. We offer a hybrid schedule, career development and growth, transparent and visible leadership teams, and a place where diversity, equity and inclusion are celebrated. In addition, the Firm offers a full array of benefits which can be viewed at

Working with Us – Come and Be Benesch!

We are one of the fastest growing firms in the nation, and have offices in Chicago, Columbus, San Francisco, New York City, and Wilmington. We continue to expand our geographic footprint and value the talent that comprises each of our locations. If you are someone who champions a First in Service approach and are ready to be part of an exciting and growing firm, we would invite you to apply to join our team.

Want to know more? To hear from some of our team, :

SOC/Incident Report Engineer – Cleveland Office

This position is hybrid with work-from-home flexibility.

Position Summary

Are you excited about detecting and resolving cybersecurity threats and incidents? Do you find it a challenge to help an organization reduce threats and enhance their security? Does working with teams to develop strategies to improve detection capabilities interest you? Then you may be interested in our SOC/Incident Report Engineer position. This role is perfect for the individual looking to play a crucial role in Benesch's security initiatives.

The SOC/Incident Response Engineer is responsible for detecting, investigating, and responding to cybersecurity incidents across the Firm. This role combines threat detection, digital forensics, malware triage, and cloud security expertise to protect organizational assets, reduce risk, and strengthen security posture. The SOC/Incident Response Engineer will operate within a 24/7 security operations environment, collaborating with cross-functional teams to analyze threats, develop response strategies, and improve detection capabilities.

Position

Responsibilities

Security Monitoring & Threat Detection

Monitors SIEM, EDR, NDR, and cloud-native security tools to identify suspicious activity and potential security incidents.

Creates, tunes, and optimizes detection rules, correlation logic, and analytic use cases.

Conducts threat hunting based on emerging TTPs, threat intel, and anomaly patterns.

Maintains and improves alerting fidelity to reduce false positives and enhance detection precision.

Incident Response & Triage

Performs initial triage of security alerts to assess severity, impact, and required response actions.

Leads full incident lifecycle activities including investigation, containment, eradication, recovery, and post‑incident analysis.

Coordinates with IT, cloud, and business teams to execute IR playbooks and minimize operational impact.

Documents incidents, findings, and lessons learned; contributes to after‑action reviews.

Digital Forensics & Malware Analysis

Conducts forensic acquisition and analysis of endpoints, servers, cloud resources, and network artifacts (disk, memory, logs).

Examines artifacts such as registry hives, event logs, file systems, network captures, browser history, and persistence mechanisms.

Performs malware triage (dynamic and static) to determine malware behavior, indicators of compromise, and propagation mechanisms.

Maintains chain‑of‑custody processes and ensures forensic data integrity for potential legal or compliance requirements.

Cloud Security & IR

Monitors and responds to security events within cloud environments (e.g., Azure, AWS, Google Cloud).

Investigates cloud-native logs:
Azure Activity Logs, AWS Cloud…

SOC​/Incident Response Engineer

SOC/Incident Response Engineer