Principal Incident Response Analyst

Blackbaud; United States; Hybrid; USD 117,000 - 158,000; Full time

Benefits offered by this job

Medical Insurance

Remote-friendly workforce

Wellness Programs

401(k) Match

Flexible PTO

Parental Leave

Donations for Doers

Pet Insurance

Identity Protection

Tuition Reimbursement

Job summary

Blackbaud is seeking a Principal Incident Response Engineer to lead detection and response efforts, perform digital forensics, and drive threat hunting across on-prem, hybrid, and cloud environments.

You will act as the technical lead for high-severity incidents and collaborate with cross-functional teams to contain, eradicate, and recover from cyber threats, while advancing AI/LLM workflows to improve detection capabilities.

Qualifications

• 8+ years of cyber incident response experience in a relevant environment.
• Hit with industry certifications such as CISSP, GCIH, GFCA, GREM, or ECIH is highly desirable.
• Subject matter expertise with security tools (SIEM, IDS/IPS, EDR) and cloud monitoring.
• Strong knowledge of incident response methodologies (containment, eradication, recovery) and frameworks (NIST, SANS, CSA).
• Ability to acquire and analyze endpoint and network artifacts, memory, and malware/scripts.

Responsibilities

• Lead high-severity security incidents as technical lead and coordinate containment.
• Perform forensic investigations to determine root cause and remediation steps.
• Collaborate with cross-functional teams to mitigate threats across on-prem, hybrid, and cloud workloads.
• Conduct intelligence-driven threat hunts to identify gaps in detection.
• Enhance coverage with MITRE ATT&CK mapping and develop AI/LLM workflows for detection.
• Support on-call rotations and work with law enforcement and legal teams as needed.

Skills

Incident response leadership

Threat hunting

Digital forensics

MITRE ATT&CK knowledge

Cloud monitoring

Tools

SIEM

EDR

IDS/IPS

EnCase

FTK

Axiom

Cellebrite

Job description

About the role

We are looking for an accomplished, high-performing Principal Incident Response Engineer for our Threat Detection & Response team with experience performing digital forensics, incident response, and threat hunting. The Principal Incident Response Engineer is responsible for ensuring the confidentiality, integrity, and availability of critical information and IT assets. This role requires a deep understanding of cybersecurity principles, incident response methodologies, digital forensics, and the ability to work efficiently under pressure.

What you'll be doing

• Conduct in-depth analysis of security events and indicators to determine the nature and severity of incidents.
• Respond promptly to security incidents, following established incident response procedures.
• Serve as the technical lead for high-severity security incidents.
• Coordinate and collaborate with cross-functional teams to contain and mitigate cyber threats effectively.
• Perform forensic investigations to determine the root cause of incidents and develop appropriate remediation strategies across on-prem, hybrid, and cloud workloads.
• Lead regular intelligence-driven threat hunt activities to identify and investigate gaps in detection.
• Partner with detection engineering to increase coverage across MITRE ATT&CK framework.
• Identify, scope, and support the development of AI/LLM workflows to enhance incident detection and response capabilities.
• Collaborate with other forensic analysts, law enforcement officers, and legal experts to identify methods and procedures for recovery, preservation, and presentation of computer evidence, ensuring proper precautions are taken in the preservation and prevention of spoliation of electronic evidence.
• Support On-call rotation as applicable.

What we’ll want you to have

• 8+ years of cyber incident response experience in a relevant environment.
• Cyber industry certifications are highly desirable (CISSP, GCIH, GFCA, GREM, ECIH).
• Subject matter expertise with security tools and technologies, such as SIEM, IDS/IPS, EDR, and cloud monitoring solutions.
• Strong knowledge of incident response methodologies, including containment, eradication, recovery, and common security frameworks (NIST, SANS, CSA).
• Ability to acquire and analyze endpoint and network artifacts, volatile memory, malicious files/binaries and scripts.
• Experience with forensic tools, such as Encase, FTK, Axiom, and Cellebrite to carry out digital forensic investigations.

Stay up to date on everything Blackbaud, follow us on Linkedin, Twitter, Instagram, Facebook and YouTube.

Blackbaud powers social impact through purpose‑driven technology and responsible AI. Guided by our Intelligence for Good® vision, we’re building a culture where innovation, trust, and human expertise come together to help organizations make a greater difference in the world.

Blackbaud is proud to be an equal opportunity employer and is committed to maintaining a diverse and inclusive work environment. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, physical or mental disability, age, or veteran status or any other basis protected by federal, state, or local law.

The starting base pay is $117,200.00 to $157,500.00.

Blackbaud may pay more or less based on employee qualifications, market value, Company finances, and other operational considerations.

Benefits Include

• Medical, dental, and vision insurance
• Remote-flexible workforce
• Wellness Programs
• 401(k) program with employer match
• Flexible paid time off
• Generous Parental Leave
• Donations for Doers
• Pet insurance, legal and identity protection
• Tuition reimbursement program

Blackbaud (NASDAQ: BLKB) is the world’s leading cloud software company powering social good. Serving the entire social good community—nonprofits, foundations, corporations, education institutions, healthcare institutions and individual change agents—Blackbaud connects and empowers organizations to increase their impact through software, services, expertise, and data intelligence. The Blackbaud portfolio is tailored to the unique needs of vertical markets, with solutions for fundraising and CRM, marketing, advocacy, peer‑to‑peer fundraising, corporate social responsibility, school management, ticketing, grantmaking, financial management, payment processing, and analytics. Serving the industry for more than three decades, Blackbaud is headquartered in Charleston, South Carolina and has operations in the United States, Australia, Canada, and the United Kingdom.