Incident Response Engineer: SOC, Forensics & Threat Hunting

Cybersecurity Jobs; Austin (TX); On-site; USD 110,000 - 170,000; Full time

Benefits offered by this job

Competitive pay and benefits

401(k) and health insurance

Tuition reimbursement

Training and long-term growth

Job summary

Kestra Financial is seeking a Cybersecurity Incident Response Engineer to support incident detection, investigation, and response across a diverse enterprise environment. This onsite role in Austin, TX collaborates across SOC operations, threat hunting, and digital forensics to drive faster containment and stronger recovery.

The position includes playbook development, audits, adversary simulation exercises, and continuous learning to stay ahead of threats.

Qualifications

• 2+ years of proven experience in a similar role.
• Bachelor’s degree in Cybersecurity or IT (or equivalent).
• Security+ or equivalent certification is preferred.
• Strong understanding of MITRE ATT&CK / Cyber Kill Chain.
• Experience with Microsoft security tooling is a plus.

Responsibilities

• Manage alerts escalated by the SOC and ensure proper review.
• Investigate and respond to security incidents using IDS suite tools.
• Perform root cause analysis and develop mitigation strategies.
• Support audits with incident response documentation and evidence.
• Lead digital forensics investigations and identify IOCs.
• Develop and maintain incident response playbooks and procedures.
• Participate in red team exercises to improve detection and response.

Skills

2+ years experience

Mitre Attack / Cyber Kill-Chain

Security+ or equivalent

Microsoft security tooling

Threat hunting

Education

Bachelor’s degree in Cybersecurity or IT

Tools

SIEM

EDR

IDS suite tools

KQL

Sentinel workbooks

Job description

Kestra Financial is seeking a Cybersecurity Incident Response Engineer to support incident detection, investigation, and response across a diverse enterprise environment. This onsite role in Austin, TX collaborates across SOC operations, threat hunting, and digital forensics to drive faster containment and stronger recovery.

The position includes playbook development, audits, adversary simulation exercises, and continuous learning to stay ahead of threats.