AI-Driven Incident Response Engineer

Blackstone; Miami (FL); On-site; USD 110,000 - 170,000; Full time

Job summary

Blackstone Technology & Innovations (BXTI) seeks an Alert, Detection, and Response Associate to join the frontline of cyber defense. You will detect, investigate, and respond to security incidents across email, endpoint, identity, network, and cloud, carrying cases from intake through closure, and escalating as needed.

You will turn investigations into lasting improvements by feeding findings back into detections, playbooks, and automation, while mentoring Tier 1 analysts and shaping

Qualifications

• 2+ years of hands-on experience in security operations, incident response, or a comparable technical security role
• Demonstrated experience running security investigations end to end, from alert through root cause and containment
• Hands-on SIEM experience with experience writing and troubleshoot your own queries; experience with a major enterprise SIEM
• Hands-on EDR experience conducting endpoint investigation and containment; experience with a leading EDR platform
• Working knowledge of cloud and identity investigation, including cloud audit logging, IAM, and SSO
• Practical understanding of attacker behavior across the intrusion lifecycle
• Experience with AI tooling in security to automate or accelerate tasks
• Clear technical writing for engineers and stakeholders

Responsibilities

• Manage an incident queue from intake through investigation, containment, and closure across email, endpoint, identity, network, and cloud
• Handle escalations raised by Tier 1 analysts and coordinate with additional responders as scope grows
• Investigate in the firm’s SIEM, writing and refining searches across telemetry
• Conduct endpoint investigation, host containment, and live response in the firm’s EDR platform
• Investigate email threats end to end, including phishing and BEC, with header and trace analysis
• Investigate cloud and identity compromise, including credential misuse and MFA bypass
• Coordinate containment and remediation with legal, vendor risk, and business owners
• Author and tune detections from findings; extend coverage with automation
• Contribute to threat hunts and purple team exercises
• Mentor Tier 1 analysts and document investigations for evidence handling and communication

Skills

Incident response

SOC operations

SIEM experience

EDR expertise

Cloud & identity investigation

Python/PowerShell scripting

AI tooling for security

Education

B.S. in Computer Science, Cybersecurity, Information Systems, or a related technical field

Tools

Splunk/SPL

Microsoft Sentinel/KQL

Elastic

CrowdStrike

SentinelOne

Microsoft Defender for Endpoint

Job description

Blackstone Technology & Innovations (BXTI) seeks an Alert, Detection, and Response Associate to join the frontline of cyber defense. You will detect, investigate, and respond to security incidents across email, endpoint, identity, network, and cloud, carrying cases from intake through closure, and escalating as needed.

You will turn investigations into lasting improvements by feeding findings back into detections, playbooks, and automation, while mentoring Tier 1 analysts and shaping