Remote Principal Incident Response Engineer

RGA Enterprise Services Company; United States; On-site; USD 140,000 - 210,000; Full time

Job summary

RGA is seeking a Principle Incident Response Engineer to lead complex cyber investigations and strengthen enterprise resilience across Windows, Linux, macOS, cloud, and hybrid environments. You will guide security teams, deliver executive-ready reports, and partner with legal, compliance, and audit stakeholders.

This role requires 8+ years in incident response, a Master’s degree, and hands-on experience with SIEM/EDR tools such as Splunk and CrowdStrike.

Qualifications

• Master's degree in Arts/Sciences (MA/MS) or equivalent experience required.
• 8+ years in incident response, DFIR, security operations, consulting, or related cybersecurity disciplines - Required.
• 10+ years of relevant experience preferred.

Responsibilities

• Lead enterprise incident response and cyber crisis engagements from detection through recovery.
• Direct investigations across Windows, Linux, macOS, M365, AWS, Azure, and hybrid environments.
• Perform advanced threat hunting and assessments using SIEM/EDR.
• Develop containment, eradication, and remediation strategies.
• Produce executive briefings and post-incident reviews.
• Partner with legal, compliance, privacy, audit stakeholders.
• Drive adoption of AI-assisted workflows to improve speed and efficiency.
• Support the 24/7 on-call rotation.

Skills

Incident response

Threat hunting

Digital forensics

Executive communication

Cloud security

Scripting

Stakeholder engagement

Education

MA/MS or equivalent

Tools

Splunk

Microsoft Defender

CrowdStrike Falcon

ServiceNow SIR

Cloud security

FTK

EnCase

X-Ways

SIFT

AWS

Azure

M365

Job description

RGA is seeking a Principle Incident Response Engineer to lead complex cyber investigations and strengthen enterprise resilience across Windows, Linux, macOS, cloud, and hybrid environments. You will guide security teams, deliver executive-ready reports, and partner with legal, compliance, and audit stakeholders.

This role requires 8+ years in incident response, a Master’s degree, and hands-on experience with SIEM/EDR tools such as Splunk and CrowdStrike.