Incident Response Engineer, Tier 2 — Detection & IR

Blackstone; Miami (FL); Hybrid; USD 110,000 - 170,000; Full time

Job summary

Blackstone seeks an Alert, Detection, and Response Associate to serve as a Tier 2 incident responder. You will detect, investigate, and respond to security incidents across email, endpoint, identity, network, and cloud, and help turn findings into improved detections and playbooks.

You will mentor Tier 1 analysts, write detections, and work with AI investigation tooling to accelerate triage while maintaining rigorous evidence handling and coordination with stakeholders.

Qualifications

• 2+ years hands‑on experience in security operations or incident response.

Responsibilities

• Manage an incident queue from intake to closure across email, endpoint, identity, network and cloud.
• Handle escalations from Tier 1 analysts for complex investigations.
• Investigate in the firm''s SIEM; write and refine searches for telemetry.
• Conduct endpoint investigation, host containment, and live response in the EDR platform.
• Investigate email threats end to end, including phishing and BEC, using header analysis.
• Investigate cloud/identity compromise, including IAM and MFA bypass scenarios.
• Coordinate with legal, compliance, vendor risk and business owners for remediation.
• Author and tune detections from findings; validate against historical data.
• Work with AI investigation tooling for triage and enrichment; improve coverage.
• Mentor Tier 1 analysts on investigation techniques and case reviews.
• Document investigations to a standard that supports chain of custody.

Skills

Incident response

SIEM querying

EDR containment

Cloud/Identity

Python/PowerShell

AI tooling in IR

MITRE ATT&CK

Technical writing

Threat hunting

Cross-team collaboration

Education

BS in CS/Cybersecurity/IS

Tools

Splunk/SPL

Microsoft Sentinel/KQL

Elastic

CrowdStrike

SentinelOne

Defender for Endpoint

Job description

Blackstone seeks an Alert, Detection, and Response Associate to serve as a Tier 2 incident responder. You will detect, investigate, and respond to security incidents across email, endpoint, identity, network, and cloud, and help turn findings into improved detections and playbooks.

You will mentor Tier 1 analysts, write detections, and work with AI investigation tooling to accelerate triage while maintaining rigorous evidence handling and coordination with stakeholders.