DFIR Engineer II: Incident Response & Threat Hunting

Northwestern Mutual; Milwaukee (WI); Hybrid; USD 89,000 - 134,000; Full time

Benefits offered by this job

Flexible work schedules

Concierge service

Comprehensive benefits

Employee resource groups

Job summary

Northwestern Mutual is seeking an experienced DFIR Engineer II to join the Threat Detection & Response team. You will respond to, investigate, and contain anomalous activity, staying current on cybersecurity threats and refining monitoring and response capabilities.

The role requires collaboration with Detection Engineering and Red Team, and participation in on-call rotations. A strong foundation in security operations and cross-platform environments is essential.

Qualifications

• Bachelor's Degree in Information Security, Computer Science, or equivalent combination of education, training, and experience.

Responsibilities

• Triage, pivot and correlate across multiple network and host-based log sources.
• Analyze system artifacts and memory for evidence of compromise.
• Proactively hunt for and identify malicious activity in various log sources using threat intelligence and other indicators of compromise.
• Document detailed findings including timelines of events or incidents
• Continually improve incident response procedures and documentation.
• Engage with Detection Engineering and Red Team to identify opportunities to better monitor/detect suspicious behavior and automate response capabilities.
• Keep up to date on evolving cyber threats and identify methods to detect them.
• Participate in an on-call rotation with other Incident ResponseEngineers

Skills

SIEM

EDR

VPN

Next-gen Firewalls

CASB

AWS

Azure

O365

Docker

Kubernetes

PowerShell

Python

Education

Bachelor's Degree in Information Security, Computer Science, or equivalent

Tools

Windows

Mac

Linux

Job description

Northwestern Mutual is seeking an experienced DFIR Engineer II to join the Threat Detection & Response team. You will respond to, investigate, and contain anomalous activity, staying current on cybersecurity threats and refining monitoring and response capabilities.

The role requires collaboration with Detection Engineering and Red Team, and participation in on-call rotations. A strong foundation in security operations and cross-platform environments is essential.