IT Security Engineer – Incident Response

Location:San Diego, CA preferred – Remote Acceptable
Work Hours:Pacific Time (PST) required for remote candidates
Contract:12 months
Pay Rate: $79-$84/HR

Our client is seeking a highly experienced IT Security Engineer to join its Security Operations Center (SOC) within Threat Operations. This is a Tier 2 Incident Response position focused on investigating and resolving complex security incidents from initial escalation through containment, remediation, and closure.

This is not a traditional SOC analyst role focused primarily on monitoring an alert queue. The ideal candidate will have extensive hands-on experience responding to security incidents, understanding the broader context and risk associated with an event, and independently driving complex incidents to resolution.

The Incident Response Engineer will work closely with other security teams and business stakeholders and will be expected to communicate clearly throughout the incident lifecycle. The team currently consists of approximately 10 members, with Tier 1 responders handling high-volume alerts and initial containment activities and Tier 2 responders taking on more complex and higher-risk incidents requiring deeper investigation and broader visibility.

• Act as a Tier 2 incident responder responsible for investigating, managing, and driving complex security incidents through resolution.
• Take ownership of escalated incidents from initial triage through containment, eradication, recovery, and closure.
• Investigate security events to determine whether they constitute a true security incident based on complexity, risk, scope, and potential business impact.
• Perform comprehensive analysis of endpoint, network, cloud, and security telemetry to determine root cause, scope, and impact.
• Leverage Crowd Strike, Splunk, and other SIEM/EDR platforms to investigate and correlate security signals.
• Analyze and correlate logs and telemetry across multiple sources to identify attacker activity, understand the broader attack chain, and determine appropriate response actions.
• Conduct host, network, and cloud forensic analysis as necessary to support investigations.
• Lead communications and coordinate response activities with security teams, technical teams, and business stakeholders.
• Provide clear, timely incident updates and communicate technical findings and recommended actions to both technical and non‑technical audiences.
• Work collaboratively with Tier 1 analysts, DFIR, Detection Engineering, Insider Risk, and other SOC capabilities during complex investigations.
• Validate that containment and remediation activities have effectively addressed the underlying threat before closing an incident.
• Identify detection gaps and false‑positive patterns discovered during investigations and communicate findings to Detection Engineering.
• Contribute to the development and improvement of incident response playbooks, runbooks, and processes.
• Participate in post‑incident reviews and translate lessons learned into improvements to detection and response capabilities.
• Stay current on attacker methodologies, emerging threats, and modern incident response techniques.

• 5+ years of experience in cybersecurity, security operations, incident response, or a closely related field.
• Strong hands‑on experience serving as an incident responder
  , preferably within a Tier 2 or similarly escalated SOC environment.
• Demonstrated ability to independently manage complex security incidents from escalation through resolution.
• Strong experience with Crowd Strike and Splunk in a security operations or incident response environment.
• Strong experience with SIEM platforms
  , including the ability to correlate and…