Cyber Incident Response Engineer II — SOC Defender

AmerisourceBergen Corporation (Cencora); Carrollton (TX); On-site; USD 90,000 - 130,000; Full time

Job summary

The Engineer II, Cyber Incident Response at Cencora leads detection, investigation, and response to cybersecurity incidents within the Security Operations Center. You will analyze alerts, correlate data, and help drive incident containment and recovery in a fast-paced environment.

You will collaborate with global cyber defense teams, contribute to playbooks, and mentor junior analysts, applying knowledge of NIST, MITRE ATT&CK, and SIEM/EDR tooling to strengthen the organization’s security

Qualifications

• Bachelor's degree in Cybersecurity, CS, IT, or equivalent experience.
• Strong knowledge of cybersecurity fundamentals and incident response methodology.
• Familiarity with NIST, MITRE ATT&CK, and ISO 27035.

Responsibilities

• Investigate and respond to cybersecurity incidents, including phishing, malware, ransomware, and unauthorized access attempts.
• Perform analysis of logs, alerts, and forensic data to determine the scope and impact of incidents.
• Escalate complex or high-severity incidents to Engineer III, Lead, or Principal staff, providing clear documentation and evidence.
• Assist in containment, eradication, and recovery activities during incident response.
• Contribute to the development and maintenance of SOC playbooks, runbooks, and standard operating procedures.
• Collaborate with threat intelligence, vulnerability management, and forensics teams to strengthen detection and response strategies.
• Participate in lessons-learned sessions and recommend improvements to SOC processes and tooling.
• Support junior analysts (Engineer I) by sharing knowledge and providing guidance on investigative techniques.

Skills

SOC operations

Incident response

SIEM

EDR

Forensic tools

Education

Bachelor's degree in Cybersecurity/CS/IT or equivalent

Tools

Splunk

CrowdStrike

Wireshark

Job description

The Engineer II, Cyber Incident Response at Cencora leads detection, investigation, and response to cybersecurity incidents within the Security Operations Center. You will analyze alerts, correlate data, and help drive incident containment and recovery in a fast-paced environment.

You will collaborate with global cyber defense teams, contribute to playbooks, and mentor junior analysts, applying knowledge of NIST, MITRE ATT&CK, and SIEM/EDR tooling to strengthen the organization’s security