Cyber Incident Response Engineer — Hands-on Forensics & Containment

jackson; Lansing (MI); On-site; USD 90,000 - 140,000; Full time

Job summary

Jackson is seeking a Security Incident Response Engineer in Michigan to join its Information Security and Privacy (JISP) team. You will act as first responder to escalated security alerts, lead containment actions, and coordinate with Legal, Financial Fraud Investigations, and HR.

You will investigate incidents with SIEM/EDR tools, perform forensics, and develop playbooks to improve detection, response, and automation across the SOC.

Qualifications

• Bachelor’s degree or equivalent experience required.
• 3+ years Information Security experience required.
• Incident Response and/or Forensics required within 180 days of hire, such as GCIH, GCFE, or GCFA.

Responsibilities

• Identifies, investigates, and responds to cybersecurity incidents, including host analysis, network forensics, log analysis, and malware triage.
• Takes the lead on immediate containment actions and initiates root cause analysis.
• Notifies on-call resources and escalates incidents to appropriate technical teams and management based on severity, impact, and established incident response procedures.
• Utilizes forensic tools, techniques, and capabilities to support account takeover investigations.
• Maintains accurate incident records, ensuring proper documentation, evidence handling, and chain of custody throughout investigations.
• Researches security trends and recommends optimization of security tools, engaging engineering staff and management for approval and assisting in implementation.
• Performs detection engineering and develops alerts, analytics, and response playbooks to improve detection and response capabilities.
• Leverages threat intelligence and Security Operations Center data to enrich investigations, analyzes incident trends, and informs improvements to detection and response capabilities.
• Provides training, mentoring, and subject matter expertise for Security Operations Center (SOC) staff.
• Defines technical requirements and provides guidance for security monitoring, logging, and incident response capabilities.
• Creates actionable after-incident reports for Security management and technical teams.
• Works with other areas of the company, finding common ground to ensure a smooth Security Incident Response process.
• Validates and ensures SOC security tools operate effectively and leads enhancements that improve detection, automation, and response outcomes.
• Leads projects that drive continuous improvement of the Incident Response program.

Skills

Incident response

Forensics

Scripting

Communication

Analytical thinking

Team collaboration

On-call readiness

Education

Bachelor's degree or equivalent

GCFE

GCFA

GCIH

CISSP (preferred)

Tools

SIEM

SOAR

EDR

PowerShell

Python

Bash

Job description

Jackson is seeking a Security Incident Response Engineer in Michigan to join its Information Security and Privacy (JISP) team. You will act as first responder to escalated security alerts, lead containment actions, and coordinate with Legal, Financial Fraud Investigations, and HR.

You will investigate incidents with SIEM/EDR tools, perform forensics, and develop playbooks to improve detection, response, and automation across the SOC.