Security Operations Engineer: Incident Response & SIEM

Encore; Coppell (TX); On-site; USD 78,000 - 101,000; Full time

Job summary

Encore's IT Security Engineering role focuses on protecting our global infrastructure through monitoring, incident detection, and rapid response. You will collaborate with systems and network engineers, and drive improvements across security platforms such as SIEM, EDR/MDR, and email security.

The position emphasizes risk reduction, playbook development, and clear communication of findings with stakeholders across the organization.

Qualifications

• 3 years of general IT experience (help desk or desktop support).
• 3 years of incident response experience.
• 3 years of experience with: DNS security, Endpoint Detection and Response, Phishing Analysis, Email Security, Data Loss Prevention, Security Awareness Training, Identity Protection, Cloud Security.

Responsibilities

• Monitor security alerts, network traffic, and user risk/activity to identify and respond to potential security incidents.
• Monitor data flows and user activities to detect and help prevent potential data loss.
• Perform triage and initial investigation of security events and suspicious activity.
• Identify false positives, tune detections under guidance, and recommend improvements.
• Execute incident response activities according to documented playbooks and procedures.
• Document incidents, findings, root causes, and remediation actions.
• Investigate security events, categorize incidents, and escalate critical or complex issues as appropriate.
• Assist with root cause analysis and participate in post-incident reviews.
• Support containment, eradication, and recovery efforts during incidents.
• Support the operation, monitoring, and health of security platforms including SIEM, EDR/MDR, email security, DNS security, identity protection, and DLP.
• Assist with SIEM onboarding, log parsing, tuning, and alert optimization.
• Assist with configuration, testing, and deployment of new security tools and capabilities.
• Participate in security platform upgrades, changes, and maintenance activities.
• Follow change management processes for security system updates and enhancements.
• Assist in troubleshooting security product issues and integration failures.
• Generate clear and concise incident reports, findings, and analysis summaries.
• Communicate security risks, incidents, and recommended actions to stakeholders as appropriate.
• Collaborate with cross-functional teams to align security operations with organizational objectives.
• Create, maintain and improve documentation, runbooks, playbooks, and operational procedures.
• Perform other duties as assigned.

Skills

General IT experience

Incident response

DNS security

EDR/MDR

Phishing analysis

Email security

Data Loss Prevention

Identity protection

Cloud security

Security operations

Blue Team

Incident response tactics

IDS/IPS

Firewalls

Proxies

SIEM

EDR

Education

Security certifications

Tools

SIEM

EDR

IDS/IPS

Firewalls

Proxies

Job description

Encore's IT Security Engineering role focuses on protecting our global infrastructure through monitoring, incident detection, and rapid response. You will collaborate with systems and network engineers, and drive improvements across security platforms such as SIEM, EDR/MDR, and email security.

The position emphasizes risk reduction, playbook development, and clear communication of findings with stakeholders across the organization.