Cybersecurity Engineer

Kestra Financial; Austin (TX); On-site; USD 110,000 - 140,000; Full time

Job summary

Kestra Financial is seeking a Cybersecurity Incident Response Engineer to join our team in Austin, TX. The role focuses on identifying, analyzing, and responding to security incidents across a diverse enterprise environment.

You will work with SIEM platforms, EDR tools, and threat intelligence frameworks to defend the organization. You will manage alerts, challenge the SOC on overlooked incidents, perform forensic investigations, and develop playbooks while staying current with security trends

Qualifications

• 2+ years of proven experience in a similar role.
• Bachelor's degree in Cybersecurity, IT or equivalent experience.
• Security+ or equivalent certification (Microsoft security certifications are a plus)
• Strong understanding of the MITRE ATT&CK/Cyber Kill Chain.
• Proficiency with Microsoft security tooling is a plus.

Responsibilities

• Manage alerts escalated by the SOC.
• Challenge the SOC on potentially overlooked incidents.
• Investigate and respond to security incidents using IDS/EDR suite tools.
• Perform root cause analysis and develop mitigation strategies.
• Perform audits.
• Collaborate with SOC analysts, IT, and other stakeholders to contain and remediate threats.
• Stay up to date with security trends, vulnerabilities, and best practices.
• Develop and maintain incident response playbooks and procedures.
• Conduct threat hunting activities using KQL and Sentinel workbooks.
• Stay current with emerging threats, vulnerabilities, and security technologies.
• Conduct digital forensics investigations to identify IOCs, determine attack vectors, and preserve evidence per standards.
• Support internal and external audit activities by providing incident response documentation and evidence.
• Contribute to the development and refinement of security policies, procedures, and practices.
• Participate in red team and adversary simulation exercises to improve detection and response capabilities.

Skills

2+ years experience

Bachelor's degree in Cybersecurity/IT

Security+ certification

Mitre ATT&CK

Microsoft security tooling

Education

Bachelor's degree in Cybersecurity/IT

Tools

Sentinel

Job description

Lead with Purpose. Partner with Impact.

We areseekinga Cybersecurity Incident Response Engineer to join our team and help defend our organization against evolving cyber threats. This role focuses onidentifying, analyzing, and responding to security incidents across a diverse enterprise environment. The ideal candidate will have experience working with modern security information and event management (SIEM) platforms, endpoint detection and response (EDR) tools, and threat intelligence frameworks.

What you'll Do:

• Manage alerts escalated by the SOC.

• Challenge the SOC onpotentially overlooked incidents.

• Investigate and respond to security incidents usingIDSsuite tools.

• Perform root cause analysis and develop mitigation strategies.

• Perform audits.

• Collaborate with SOC analysts, IT, and other stakeholders tocontainand remediate threats.

• Continuous Learning:Stayup to datewith security trends, vulnerabilities, and best practices.

• Develop andmaintainincident response playbooks and procedures.

• Conduct threat hunting activities using KQL and Sentinel workbooks.

• Stay current with emerging threats, vulnerabilities, and security technologies.

• Conduct digital forensics investigations toidentifyindicators of compromise (IOCs),determineattack vectors, and preserve evidencein accordance withlegal and organizational standards.

• Support internal and external audit activities by providing incident response documentation andevidence.

• Contributesto the development and refinement of security policies, procedures, and operational practices.

• Participate in red team and adversary simulation exercises to improve detection and response capabilities.

What You Bring:

• 2+ years of proven experience in a similar role.
• Bachelor's degree inCybersecurity,ITor equivalent experience.
• Security+ or equivalent certification (Microsoftsecurity certifications are a plus)
• A strong understanding of theMitreAttack/Cyber Kill-Chain.
• Proficiency/hands-onexperienceinMicrosoft security toolingis a plus.