Lead Security Engineer - Detection & Response

Lockton; North Kansas City (MO); On-site; USD 110,000 - 160,000; Full time

Job summary

Lockton is seeking a Security Engineer – Detection & Response to join the Global Security Operations team in the US. You will lead incident responses from detection through recovery, while also building CTI capabilities and conducting threat hunts to strengthen detections.

The role combines hands-on incident management with adversary emulation, red team/purple team exercises, and continuous improvement of playbooks.

Qualifications

• Bachelor’s degree in Computer Science, Information Security, or related field, or equivalent experience.
• Minimum 5 years of information security with hands-on incident response, forensics, CTI, threat hunting, red team or pen testing.
• Certifications such as GCIH, GCFA, GCTI, GREM, OSCP, CRTO, or CISSP are desirable.
• Experience with MITRE ATT&CK and applying it to threat hunting and detections.
• Hands-on with EDR and SIEM platforms including CrowdStrike Falcon, MS Sentinel, and MS Defender XDR.
• Strong scripting (PowerShell, Python, KQL) for automation and detections.
• Experience with adversary emulation tooling and safe run in prod.
• Excellent problem-solving, communication, and team collaboration.

Responsibilities

• Lead the technical response to security incidents, coordinating with IT, Legal, HR, Communications, and stakeholders to scope, contain, eradicate, and recover.
• Conduct digital forensic investigations across endpoint, identity, email, and cloud; produce detailed reports.
• Perform root cause analysis and turn findings into changes to detections and playbooks.
• Plan and run tabletop exercises with technical and executive audiences across regions.
• Build and run Lockton’s CTI capability; track threat actors and produce threat briefings.
• Lead intelligence-driven threat hunts; turn findings into durable detections.
• Plan and execute red team and purple team exercises; emulate attacker TTPs.
• Tune detections and SOC playbooks; mentor on investigation techniques.

Skills

Incident response

Digital forensics

Threat hunting

MITRE ATT&CK

EDR/SIEM

CrowdStrike

Powershell/Python

Adversary emulation

Communication skills

Team collaboration

Education

Bachelor’s degree in Computer Science or related field

Tools

CrowdStrike Falcon

Microsoft Sentinel

Microsoft Defender XDR

PowerShell

Python

KQL

Job description

Lockton is seeking a Security Engineer – Detection & Response to join the Global Security Operations team in the US. You will lead incident responses from detection through recovery, while also building CTI capabilities and conducting threat hunts to strengthen detections.

The role combines hands-on incident management with adversary emulation, red team/purple team exercises, and continuous improvement of playbooks.