Incident Response Eng

American Technology Services LLC; Atlanta (GA); On-site; USD 110,000 - 160,000; Full time

Job summary

American Technology Services LLC in Atlanta, Georgia is seeking an experienced Incident Response Engineer to join our Cybersecurity team. You will detect, triage, and respond to security incidents across enterprise systems, cloud apps, and data exchanges.

You will lead incident response playbooks, post-mortems, and threat hunting initiatives, collaborating with cross-functional teams to continually improve detection and response capabilities.

Qualifications

• Bachelor’s degree or equivalent experience required; cybersecurity certifications preferred.
• 6+ years of cybersecurity experience with incident handling/response.
• Strong understanding of cybersecurity tools, technologies, and methodologies.
• Familiarity with MITRE ATT&CK and ITIL.
• Excellent written and verbal communication skills.
• Ability to work independently and in a team.

Responsibilities

• Serve as primary responder to security incidents, triaging alerts.
• Collaborate to document and coordinate incident response processes.
• Maintain cybersecurity documentation and incident response playbooks.
• Lead post-mortems and produce written reports.
• Analyze logs and EDR telemetry across systems.
• Investigate Windows, Linux, iOS, and cloud platforms using SIEM.
• Participate in global on-call rotation.
• Identify automation opportunities and improve detection.
• Conduct proactive threat hunting to identify TTPs.
• Assess threats using threat intelligence.
• Assist in forensic acquisition, malware analysis, and network analysis.

Skills

Incident handling

Security operations

Threat hunting

Cloud security

Windows/Linux

Communication skills

Documentation

Automation

Teamwork

Log analysis

Education

Bachelor's degree or equivalent

Cybersecurity certifications preferred

Tools

SIEM tools

EDR tools

Forensic tools

Job description

Incident Response Eng

American Technology Services LLC Atlanta, Georgia, United States

About this position

About American Technology Services LLC

American Technology Services (ATS) started in 1994 with the same mission as today, providing high-quality managed IT services, network support, and cybersecurity services to firms where quality matters most – the organizations that rely heavily on information technology and high levels of services. Over the years, ATS has built client trust that has lasted for years and years. As time goes forward, our consultative approach resonates well, and our “corporate knowledge” about our clients’ IT operations helps our clients perform at a higher level.

About the role

At ATS, you’ll join a dedicated team focused on Incident Detection & Response, working to protect the people, processes, and technology of our organization. We are seeking an experienced and adaptable Security Operations Engineer to join our Cybersecurity team. This role reports to the Cybersecurity Manager and will play a critical part in responding to cybersecurity incidents across the enterprise.

What you'll do

• Serve as a primary responder to security incidents, including the monitoring, triaging, and investigation of security alerts in a timely manner.
• Collaborate with cross‑functional teams to document, enhance, and coordinate Incident Response processes.
• Maintain and organize Cybersecurity documentation, including the creation and upkeep of incident response playbooks.
• Participate in and/or lead incident post‑mortems, distilling lessons learned into actionable recommendations and comprehensive written reports.
• Analyze logs and EDR telemetry across a variety of systems, including medical devices, cloud applications, workstations, and data exchange platforms.
• Conduct investigations across Windows, Linux, iOS, and cloud platforms using SIEM tools and manual log analysis.
• Participate in a global on‑call rotation.
• Identify opportunities for automation and for improving detection capabilities.
• Perform proactive threat hunting to identify emerging tactics, techniques, and procedures (TTPs).
• Assess and respond to new and evolving threats using threat intelligence to evaluate likelihood and organizational impact.
• Assist in forensic acquisition, malware analysis, and network analysis.

Qualifications

• Bachelor’s degree in a related field or equivalent experience required; Cybersecurity certifications strongly preferred.
• 6+ years of experience in Cybersecurity, including direct incident handling/response.
• Strong understanding of Cybersecurity tools, technologies, and methodologies.
• Working knowledge of common IT technologies and operational processes.
• Familiarity with relevant frameworks and standards, such as MITRE ATT&CK and ITIL.
• Solid understanding of risk management principles and practices.
• Proven ability to translate abstract requirements into clear, actionable steps.
• Excellent written and verbal communication skills, including the ability to convey technical concepts to non‑technical audiences.
• Strong work ethic with exceptional attention to detail and organizational skills.
• Ability to prioritize and multitask effectively in a fast‑paced environment.
• Capable of working both independently and collaboratively within a team.
• Conceptual understanding of software development methodologies.
• Experience with application security, SaaS, or cloud security is a plus.
• Experience with programming or scripting languages is a plus.
• Familiarity with cloud environments (e.g., AWS, Azure) and automation frameworks.