IT Security Engineer – Incident Response

Gravity IT Resources; San Diego (CA); Hybrid; USD 109,000 - 116,000; Full time

Job summary

Gravity IT Resources is seeking an IT Security Engineer IV – Incident Response to join its SOC in Threat Operations. The role focuses on investigating and resolving complex security incidents from escalation through containment and closure, requiring hands-on incident response in a Tier 2 SOC environment.

The successful candidate will analyze endpoints, networks, and cloud telemetry using CrowdStrike, Splunk, and other SIEM/EDR platforms, coordinate with cross-functional teams, and drive

Qualifications

• 5+ years of experience in cybersecurity, security operations, incident response, or a closely related field.
• Strong hands-on experience as an incident responder, preferably in Tier 2 or escalated SOC.
• Demonstrated ability to independently manage complex security incidents from escalation through resolution.
• Strong experience with CrowdStrike and Splunk in a security operations or incident response environment.
• Strong experience with SIEM platforms and correlating signals across multiple data sources.
• Strong AWS security and cloud environment experience.

Responsibilities

• Act as a Tier 2 incident responder managing and driving complex security incidents through resolution.
• Take ownership of escalated incidents from initial triage through containment, eradication, recovery and closure.
• Investigate security events to determine true incidents based on complexity, risk, scope, and business impact.
• Analyze endpoint, network, cloud, and security telemetry to determine root cause and impact.
• Lead communications and coordinate response with security teams and stakeholders.
• Validate containment and remediation effectiveness and close incidents accordingly.
• Develop and improve incident response playbooks and runbooks.

Skills

Incident responder

CrowdStrike

Splunk

AWS security

SIEM platforms

Incident response

Tools

SIEM/EDR platforms

Job description

IT Security Engineer IV – Incident Response

Location:San Diego, CA preferred – Remote Acceptable
Work Hours:Pacific Time (PST) required for remote candidates
Contract:12 months
Pay Rate: $79-$84/HR

Position Overview

Our client is seeking a highly experienced IT Security Engineer to join its Security Operations Center (SOC) within Threat Operations. This is a Tier 2 Incident Response position focused on investigating and resolving complex security incidents from initial escalation through containment, remediation, and closure.

This is not a traditional SOC analyst role focused primarily on monitoring an alert queue. The ideal candidate will have extensive hands-on experience responding to security incidents, understanding the broader context and risk associated with an event, and independently driving complex incidents to resolution.

The Incident Response Engineer will work closely with other security teams and business stakeholders and will be expected to communicate clearly throughout the incident lifecycle. The team currently consists of approximately 10 members, with Tier 1 responders handling high-volume alerts and initial containment activities and Tier 2 responders taking on more complex and higher-risk incidents requiring deeper investigation and broader visibility.

Key Responsibilities

• Act as a Tier 2 incident responder responsible for investigating, managing, and driving complex security incidents through resolution.
• Take ownership of escalated incidents from initial triage through containment, eradication, recovery, and closure.
• Investigate security events to determine whether they constitute a true security incident based on complexity, risk, scope, and potential business impact.
• Perform comprehensive analysis of endpoint, network, cloud, and security telemetry to determine root cause, scope, and impact.
• Leverage CrowdStrike, Splunk, and other SIEM/EDR platforms to investigate and correlate security signals.
• Analyze and correlate logs and telemetry across multiple sources to identify attacker activity, understand the broader attack chain, and determine appropriate response actions.
• Conduct host, network, and cloud forensic analysis as necessary to support investigations.
• Lead communications and coordinate response activities with security teams, technical teams, and business stakeholders.
• Provide clear, timely incident updates and communicate technical findings and recommended actions to both technical and non‑technical audiences.
• Work collaboratively with Tier 1 analysts, DFIR, Detection Engineering, Insider Risk, and other SOC capabilities during complex investigations.
• Validate that containment and remediation activities have effectively addressed the underlying threat before closing an incident.
• Identify detection gaps and false‑positive patterns discovered during investigations and communicate findings to Detection Engineering.
• Contribute to the development and improvement of incident response playbooks, runbooks, and processes.
• Participate in post‑incident reviews and translate lessons learned into improvements to detection and response capabilities.
• Stay current on attacker methodologies, emerging threats, and modern incident response techniques.

Required Qualifications

• 5+ years of experience in cybersecurity, security operations, incident response, or a closely related field.
• Strong hands‑on experience serving as an incident responder, preferably within a Tier 2 or similarly escalated SOC environment.
• Demonstrated ability to independently manage complex security incidents from escalation through resolution.
• Strong experience with CrowdStrike and Splunk in a security operations or incident response environment.
• Strong experience with SIEM platforms, including the ability to correlate and investigate security signals across multiple data sources.
• Strong AWS security and cloud environment experience.
• Experience investigating endpoint, network, and cloud‑based security incidents.
• Ability to distinguish between routine security events/alerts and higher‑risk incidents requiring escalation and coordinated response.
• Excellent written and verbal communication skills, with the ability to clearly communicate technical findings, risk, status, and recommended actions.
• Strong analytical and problem‑solving skills, with the ability to see the broader picture beyond an individual alert.
• Experience working in a high‑pressure environment with multiple concurrent investigations.

Preferred Qualifications

• Experience in a Tier 2 SOC, Incident Response, DFIR, or Security Operations role.
• Experience with ServiceNow Security Incident Response (SIR)or a comparable ITSM/SIR platform.
• Experience with digital forensics and root‑cause analysis.
• Experience with security automation and incident response workflows.
• Familiarity with MITRE ATT&CK and common attacker tactics, techniques, and procedures.
• Experience working in software, SaaS, fintech, or other technology‑focused organizations.
• Relevant security certifications such as GCIH, GCIA, CISSP, CISM, or equivalent.

What Success Looks Like

The successful candidate will be someone who can receive a complex escalation and take ownership rather than simply pass it to someone else. They should be comfortable determining the severity and risk of an incident, gathering the necessary evidence, identifying what happened, coordinating the appropriate response, and driving the issue through containment and resolution.

This person should be comfortable managing approximately three concurrent complex incidents over several weeks, maintaining strong communication and documentation throughout each investigation.

The ideal candidate is a seasoned incident responder who can look beyond an individual alert, understand the bigger picture, and make sound decisions about when and how an incident needs to be escalated and resolved.

Equal Employment Opportunity Statement
Gravity IT Resources is an Equal Opportunity Employer. We are committed to creating an inclusive environment for all employees and applicants. We do not discriminate on the basis of race, color, religion, sex (including pregnancy, sexual orientation, or gender identity), national origin, age, disability, genetic information, veteran status, or any other legally protected characteristic. All employment decisions are based on qualifications, merit, and business needs.