Security Incident Response Engineer - Cloud & Automation

Saragossa; New York (NY); On-site; USD 110,000 - 165,000; Full time

Job summary

Saragossa is scaling its security function and seeks hands-on security professionals to hunt threats, triage alerts, and support containment across Azure and AWS environments. You will surface suspicious activity with KQL, investigate incidents, and help shape a growing, agile incident response team.

You will work across identity and endpoint telemetry, bring automation and AI into processes, and influence how security is built in a dynamic portfolio of companies.

Qualifications

• Hands-on experience with the Microsoft Security ecosystem and confidence applying it in investigations.
• Experience in SecOps or incident response and desire to influence how a growing team operates.
• Familiarity with cloud environments, identity platforms, endpoints, and telemetry.

Responsibilities

• Hunt threats, triage alerts, support containment, and improve detection and response.
• Work across Azure and AWS environments digging into identity and endpoint telemetry.
• Write queries (KQL) to surface suspicious activity and support triage, investigation, and response.
• Bring automation and AI into how the team operates, e.g., copilots or ML-based detections.

Skills

KQL

Azure

AWS

Incident response

SecOps

Automation

AI in security

Tools

Microsoft Security ecosystem

Job description

Saragossa is scaling its security function and seeks hands-on security professionals to hunt threats, triage alerts, and support containment across Azure and AWS environments. You will surface suspicious activity with KQL, investigate incidents, and help shape a growing, agile incident response team.

You will work across identity and endpoint telemetry, bring automation and AI into processes, and influence how security is built in a dynamic portfolio of companies.