Cyber Defense Incident Response Engineer

ASM Research, An Accenture Federal Services Company; Oklahoma City (OK); On-site; USD 67,000 - 82,000; Full time

Job summary

ASM Research, An Accenture Federal Services Company, invites a Mid-level Cybersecurity Incident Response Engineer to join its government-focused security operations team in the United States. You will analyze incidents, develop runbooks, and coordinate containment across enterprise networks.

The role emphasizes automation, forensics, and aligning incident handling with federal security policies, with opportunities to influence SOC capabilities and defensive measures.

Qualifications

• 4–7 years of hands-on cybersecurity operations and incident response.
• Bachelor’s degree in IT, Cybersecurity, CS, or related field, or equivalent.
• Experience with incident response tools such as SIEM, IDS/IPS, and EDR.

Responsibilities

• Analyze security events and incidents with SIEM/EDR to identify attack vectors and data exposure.
• Develop runbooks and automation workflows for triage, containment, and eradication.
• Coordinate system and network isolation with infra and apps while preserving evidence.
• Support proactive defense engineering, tuning detections and building countermeasures.
• Forensics activities including log review and artifact collection to support investigations.
• Map attacker behavior to MITRE ATT&CK to guide detections and responses.
• Ensure incident handling aligns with data security policies and compliance.
• Document incidents with timelines and lessons learned for security improvement.

Skills

Incident response

Cybersecurity operations

Analytical thinking

Communication skills

Education

Bachelor's degree in IT, Cybersecurity, CS or related field

Tools

SIEM

IDS/IPS

EDR

Job description

ASM Research, An Accenture Federal Services Company, invites a Mid-level Cybersecurity Incident Response Engineer to join its government-focused security operations team in the United States. You will analyze incidents, develop runbooks, and coordinate containment across enterprise networks.

The role emphasizes automation, forensics, and aligning incident handling with federal security policies, with opportunities to influence SOC capabilities and defensive measures.