Lead Detection & Incident Response Engineer

Mundi; Los Angeles (CA); On-site; USD 150,000 - 190,000; Full time

Benefits offered by this job

Equity

Job summary

K2 Space is seeking a security operations professional to own detection and response for our corporate environment. You’ll run and mature our SIEM, build detections mapped to MITRE ATT&CK, and lead incidents from first signal through containment and lessons learned across endpoints, identity, SaaS, and cloud telemetry.

The ideal candidate has 5+ years in security operations, hands-on SIEM experience (Splunk, Sentinel, Elastic, Panther, Chronicle), and a proven record of guiding incidents

Qualifications

• 5+ years of experience in security operations, detection and response, or incident response.
• Hands-on SIEM administration and tuning, including log onboarding and detector development.
• Experience leading security incidents end to end, from detection to post-incident review.
• Strong knowledge of MITRE ATT&CK and practical evidence sources.
• Experience with endpoint, identity, network, and cloud telemetry across macOS, Windows, and Linux.

Responsibilities

• Own day-to-day detection and response across the corporate environment.
• Administer and mature the SIEM, including log source onboarding, parsing, and normalization, telemetry enrichment, rule tuning, and platform health, retention, and cost.
• Write, test, and maintain detection content mapped to MITRE ATT&CK using detection-as-code practices.
• Act as incident commander for corporate security incidents, coordinating stakeholders and delivering timelines, root cause analysis, and post-incident follow-through.
• Build response playbooks and automation across SOAR, scripting, and vendor APIs to reduce time to detect, triage, and contain.
• Threat hunt proactively across endpoint, identity, SaaS, and cloud telemetry using threat intelligence and hypotheses about adversary behavior.
• Run adversary emulation and purple team exercises to validate detection coverage, then close the gaps you find.
• Perform host, network, and cloud forensics across macOS, Windows, and Linux to reconstruct attacker activity and scope impact.
• Investigate phishing, business email compromise, credential abuse, and insider risk in partnership with IT, HR, and Legal.
• Partner with IT and infrastructure teams to harden identity, endpoint, and network controls, including conditional access, EDR policy, MDM baselines, segmentation, and secure remote access, informed by what investigations reveal.
• Translate detection and incident findings into vulnerability management priorities and security architecture improvements.
• Participate in an on-call rotation for security escalations, including occasional after-hours and weekend response.
• Maintain runbooks, detection documentation, and standard operating procedures, and mentor junior team members on investigation and response tradecraft.
• Support compliance and audit efforts by producing monitoring, detection, and incident response evidence as needed

Skills

Security operations

SIEM administration

Incident response leadership

MITRE ATT&CK

Telemetry across endpoints/cloud

Programming for automation

OS & networking knowledge

Communication under pressure

Education

Bachelor’s degree in security engineering, cyber security, computer science, engineering, math, or other STEM

Tools

Splunk

Microsoft Sentinel

Elastic

Panther

Chronicle

Job description

K2 Space is seeking a security operations professional to own detection and response for our corporate environment. You’ll run and mature our SIEM, build detections mapped to MITRE ATT&CK, and lead incidents from first signal through containment and lessons learned across endpoints, identity, SaaS, and cloud telemetry.

The ideal candidate has 5+ years in security operations, hands-on SIEM experience (Splunk, Sentinel, Elastic, Panther, Chronicle), and a proven record of guiding incidents