Incident Response Engineer

We are seeking an Incident Response Engineer to join the IR team. This technical role focuses on active investigation, threat mitigation, and the continuous improvement of the security organizations posture through detection engineering and automation development.
The successful candidate will be responsible for the full lifecycle of security incidents, from initial triage to recovery. Beyond reactive response, this role involves tuning SIEM correlation rules and developing SOAR workflows to increase operational efficiency.
What Youll Be Doing:
Incident Management: Execute the IR lifecycle (Triage, Containment, Eradication, Recovery) for complex security events.
Technical Investigation: Perform root cause analysis and forensic examination across Windows, Mac, and Linux environments.
Detection & Tuning: Collaborate with the IR team to create, test, and tune SIEM rules and dashboards to reduce false positives and improve visibility.
Automation Engineering: Build and refine SOAR playbook

דרישות:

Experience as a SecOps/IR Analyst or Engineer with a heavy focus on active investigation.
Deep understanding of the Incident Response lifecycle (Triage, Containment, Eradication, Recovery).
Hands-on experience handling and managing security alerts, performing root cause analysis, and leading investigations.
Experience working across cloud providers (Azure, AWS, GCP) to identify and mitigate cloud-native threats.
Strong knowledge of operating systems (Mac, Windows, Linux) and their respective artifacts.
Proficiency with Splunk or other SIEM platforms for log analysis and threat hunting.
Experience with XSOAR or other security automation tools from an end-user/analyst perspective.
Strong knowledge of security technologies, including EDR, Mail Relay, Vulnerability Scanning, Secure Access, and MDM.
Scripting experience with Python or Bash to assist in data parsing and investigation tasks.
Nice to Have:
Detection Engineering: Ability to build and improve SIEM rules, correlations, and dashb