IT Security Engineer IV – DFIR & Detection

We are seeking a Senior Security Engineer with strong experience across Digital Forensics and Incident Response (DFIR), detection engineering, security automation and cloud security.

This is a hands-on engineering role supporting a large-scale security operations environment. The position will work closely with incident response and data loss prevention teams to investigate complex security activity, improve security visibility, engineer detections and build capabilities that make the broader security operations team more effective.

This is a 12-month remote contract opportunity. Candidates located in Central Time are strongly preferred, with Eastern Time candidates also considered.

• Perform advanced incident investigations involving endpoint, cloud, malware, identity, application and security telemetry
• Serve as a technical escalation resource for complex security incidents and forensic investigations
• Develop, tune and improve security detections using Splunk and other security platforms
• Write and optimize SPL queries for detection, investigation and security analytics
• Use Crowd Strike and related endpoint telemetry to investigate suspicious activity
• Analyze AWS security and logging data across cloud environments
• Build Python scripts and API-based automation to improve investigation, enrichment and detection workflows
• Identify and onboard additional security data sources to improve visibility and response capabilities
• Partner with DLP teams to develop and improve detections involving web activity, data movement and potential data loss
• Reduce noise and improve signal quality across high-volume security platforms
• Support secure movement and processing of security telemetry through cloud and API-based pipelines
• Evaluate and safely use AI-assisted security capabilities where appropriate

• 4+ years of experience in cybersecurity, including hands‑on detection engineering and/or DFIR
• Strong experience with Splunk and SPL
• Hands‑on Crowd Strike experience
• Experience performing security incident investigations and analyzing security telemetry
• Python scripting or security automation experience
• Experience working with AWS security logs, services or cloud investigations
• Strong understanding of detection engineering concepts and security monitoring
• Ability to independently investigate complex technical problems and develop practical solutions

• Experience with Zscaler, particularly web traffic, logging or security monitoring
• Data Loss Prevention (DLP) experience
• Cloud forensics experience
• Malware analysis or endpoint forensics experience
• Experience building security pipelines using APIs, AWS Lambda or similar technologies
• Experience with Service Now Security Incident Response
• Experience in a large SaaS, software, fintech or cloud-heavy enterprise environment
• Familiarity with AI-assisted security analysis or AI-related security investigations

The ideal candidate is not simply someone who has deployed security tools. We are looking for someone who has used those tools to investigate difficult security problems, build better detections and improve the capabilities of a security operations team.

Gravity IT Resources is an Equal Opportunity Employer. We are committed to creating an inclusive environment for all employees and applicants. We do not discriminate on the basis of race, color, religion, sex (including pregnancy, sexual orientation, or gender identity), national origin, age, disability, genetic information, veteran status, or any other legally protected characteristic. All employment decisions are based on qualifications, merit, and business needs.