Cybersecurity Incident Response Engineer — Rapid IR & Forensics

ASM Research, An Accenture Federal Services Company; Des Moines (IA); On-site; USD 67,000 - 82,000; Full time

Job summary

ASM Research is seeking a Mid Cybersecurity Incident Response Engineer to support detection, containment, and recovery of incidents across enterprise networks and mission‑critical systems in a highly regulated government environment.

You will develop runbooks, automate response workflows, coordinate with cross‑functional teams to isolate affected systems, and contribute to proactive defensive initiatives and incident documentation.

Qualifications

• Typically 4–7 years of hands-on cybersecurity incident response experience.
• Bachelor’s degree in IT, Cybersecurity, CS, or equivalent.
• Experience with incident response tools like SIEM, IDS/IPS, and EDR.
• Strong written and verbal communication and analytical skills.

Responsibilities

• Conduct technical analysis of security events and incidents using SIEM, IDS/IPS, EDR to identify attack vectors and affected assets.
• Develop and refine incident response runbooks and automation workflows to standardize triage, containment, and eradication steps.
• Coordinate system and network isolation strategies with infrastructure and application teams to contain threats while preserving evidence.
• Support proactive defensive engineering initiatives, including tuning detections and building automated countermeasures.
• Perform host and network forensics to support root cause analysis and compliance needs.
• Map observed adversary behavior to MITRE ATT&CK to guide detections improvements.
• Ensure incident handling aligns with data security best practices and regulatory requirements.
• Produce incident documentation, timelines, and lessons learned for security awareness and process improvements.

Skills

Incident response

SIEM

EDR

Analytical thinking

Education

Bachelor's degree in IT / Cybersecurity / CS

Tools

SIEM

IDS/IPS

EDR

Job description

ASM Research is seeking a Mid Cybersecurity Incident Response Engineer to support detection, containment, and recovery of incidents across enterprise networks and mission‑critical systems in a highly regulated government environment.

You will develop runbooks, automate response workflows, coordinate with cross‑functional teams to isolate affected systems, and contribute to proactive defensive initiatives and incident documentation.