Security Operations Engineer – Incident Response

AirLife; Grand Rapids (MI); On-site; USD 95,000 - 140,000; Full time

Job summary

AirLife is seeking a Security Engineer – Security Operations & Incident Response to monitor, triage, and investigate security events across AirLife’s global environment. You will lead incident response, containment, and recovery, while maturing detection rules, alert quality, and security automation.

Collaborating with Arctic Wolf and cross‑functional teams, you will advance AirLife’s security posture, implement runbooks, and support vulnerability management and disaster recovery efforts.

Qualifications

• Bachelor's degree or equivalent in cybersecurity/IT.
• Relevant security operations/incident response certifications preferred.

Responsibilities

• Monitor, triage, and investigate events across AirLife’s environment.
• Lead incident response and post‑incident reviews.
• Improve detection rules, alert quality, and response playbooks.
• Operate and integrate SIEM/EDR and cloud security tools.
• Coordinate with Arctic Wolf on tuning and investigations.
• Remediate vulnerabilities with cross‑functional teams.
• Support backup/disaster recovery operations.

Skills

SIEM expertise

Incident response leadership

EDR experience

Cloud security

Vulnerability management

Playbooks & runbooks

Zero Trust principles

Identity & access (AD, Entra)

Threat hunting basics

Automation & orchestration

Education

Bachelor's in Cybersecurity / IT

Security certifications (CompTIA Security+ / GCFA)

Tools

Arctic Wolf MDR coordination

Rubrik/Azure DR

KnowBe4 security awareness

Job description

AirLife is seeking a Security Engineer – Security Operations & Incident Response to monitor, triage, and investigate security events across AirLife’s global environment. You will lead incident response, containment, and recovery, while maturing detection rules, alert quality, and security automation.

Collaborating with Arctic Wolf and cross‑functional teams, you will advance AirLife’s security posture, implement runbooks, and support vulnerability management and disaster recovery efforts.