Incident Response Engineer

Responders with 3 to 5 years of experience to handle triage

Triage and investigate security alerts and suspected incidents across endpoint, identity, email, network, and cloud environments.
Scope incidents, assess severity and business impact, identify affected assets and accounts, and coordinate appropriate containment and remediation actions.
Collaborate with ReliaQuest GreyMatter and the managed detection and response function to investigate escalations, validate findings, and coordinate response activities.
Investigate phishing, malicious email, and related threats using Proofpoint and available email-security telemetry

Responsibilites:

Triage and investigate security alerts and suspected incidents across endpoint, identity, email, network, and cloud environments.
Collaborate with ReliaQuest GreyMatter and the managed detection and response function to investigate escalations, validate findings, and coordinate response activities.
Investigate phishing, malicious email, and related threats using Proofpoint and available email-security telemetry

Must-haves
Hands-on IR, DFIR, SOC, or threat detection experience.
Experience with an enterprise EDR (CrowdStrike Falcon is preferred, but any is acceptable).
Experience with a SIEM (Splunk preferred, but comparable tools count).
Triage, scoping, containment, and remediation experience, plus solid technical writing.
Strong analytical and communication skills, and the ability to work independently while collaborating with internal teams and external providers.

Nice-to-haves
CrowdStrike and Splunk specifically.
MDR experience (ReliaQuest GreyMatter is their provider).
Proofpoint or similar email security.
Experience with identity compromise, phishing, endpoint compromise, network intrusion, or cloud incidents.
ThreatLocker, NDR tools like Vectra, and identity security tools.