Cybersecurity IR Engineer: Automation Playbooks

ASM Research, An Accenture Federal Services Company; Olympia (WA); On-site; USD 67,000 - 82,000; Full time

Job summary

ASM Research, An Accenture Federal Services Company, seeks a Mid-level Cybersecurity Incident Response Engineer to strengthen our government-focused security operations. The role centers on detection, containment, and recovery of incidents across enterprise networks, with emphasis on automation, scripting, and playbooks to accelerate response.

You will work with cross-functional teams to isolate affected systems, improve detection logic, and contribute to proactive defensive programs while

Qualifications

• Bachelor’s degree in IT, Cybersecurity, Computer Science, or related field, or equivalent work experience.
• Hands-on experience with incident response tools such as SIEM, IDS/IPS, and EDR in enterprise environments.
• Strong incident response principles, containment and eradication techniques, and data security best practices.
• Proven analytical and problem-solving ability with strong written and verbal communication skills.

Responsibilities

• Analyze security events and incidents using SIEM, IDS/IPS, EDR to identify attack vectors and affected assets.
• Develop and refine incident response runbooks and automation workflows.
• Coordinate system and network isolation with infrastructure and application teams.
• Support proactive defensive engineering, tuning detections and building countermeasures.
• Perform host and network forensics to support root cause analysis.
• Map adversary behavior to MITRE ATT&CK to improve detections.
• Ensure incident handling aligns with data security policies and regulations.

Skills

Analytical thinking

Problem solving

Written communication

Verbal communication

Leadership

Education

Bachelor’s degree in IT, Cybersecurity, CS, or related field

Job description

ASM Research, An Accenture Federal Services Company, seeks a Mid-level Cybersecurity Incident Response Engineer to strengthen our government-focused security operations. The role centers on detection, containment, and recovery of incidents across enterprise networks, with emphasis on automation, scripting, and playbooks to accelerate response.

You will work with cross-functional teams to isolate affected systems, improve detection logic, and contribute to proactive defensive programs while