Lead Incident Response & Forensics Engineer

Emploive; Lansing (MI); On-site; USD 90,000 - 130,000; Full time

Job summary

Emploive is seeking a Security Incident Response Engineer to join the Jackson Information Security and Privacy (JISP) Security Incident Response Team. The role handles first-response to escalated security alerts, performs forensic investigations, and coordinates with Legal, Financial Fraud Investigations, and HR.

You will lead containment, root‑cause analysis, and incident documentation. Ideal candidates have 3+ years in information security, experience with SIEM/EDR and scripting, and knowledge

Qualifications

• Bachelor's degree or equivalent experience required.
• 3+ years information security experience required.
• Incident Response and/or Forensics within 180 days of hire desired (GCIH/GCFE/GCFA).
• CISSP preferred.

Responsibilities

• Identifies, investigates, and responds to cybersecurity incidents (host, network, logs, malware).
• Leads containment actions and initiates root cause analysis.
• Notifies on-call resources and escalates to teams per procedures.
• Supports account takeover investigations with forensic tools and data.
• Maintains incident records and chain of custody throughout investigations.
• Researches threats and suggests tool optimization with engineering input.
• Develops detection analytics and response playbooks.
• Uses threat intel to improve detection and response capabilities.
• Provides SOC training and SME guidance to staff.
• Defines requirements for monitoring, logging, and response capabilities.
• Creates after-incident reports for security leadership and technical teams.
• Collaborates with other teams to ensure smooth incident response processes.
• Validates SOC tools and leads enhancements for automation and response.

Skills

Incident response

Networking basics

Documentation

Communication

Root cause analysis

Automation concepts

Cloud concepts

Education

Bachelor's degree or equivalent

Tools

SIEM

SOAR

EDR

Forensic tools

PowerShell

Python

Bash

Job description

Emploive is seeking a Security Incident Response Engineer to join the Jackson Information Security and Privacy (JISP) Security Incident Response Team. The role handles first-response to escalated security alerts, performs forensic investigations, and coordinates with Legal, Financial Fraud Investigations, and HR.

You will lead containment, root‑cause analysis, and incident documentation. Ideal candidates have 3+ years in information security, experience with SIEM/EDR and scripting, and knowledge