Security Operations & Incident Response Engineer

Airlife; Town of Grand Rapids (WI); On-site; USD 110,000 - 150,000; Full time

Benefits offered by this job

Medical benefits

401(k) plan

Paid time off

Bonus potential

Job summary

AirLife is seeking a Security Engineer for Security Operations & Incident Response to monitor, triage, and investigate security events globally. You will lead incident response, containment, and recovery while maturing detection, alert quality, and automation across SIEM, EDR, and cloud tooling.

Required 3–5 years in IT with 2+ years in security operations. Bachelor’s in a related field and relevant certifications are preferred. Travel up to 10% may apply.

Qualifications

• Strong understanding of security operations concepts, including SIEM, log analysis, and alert triage.
• Hands-on experience leading incident response activities in an enterprise environment.
• Experience tuning detection rules and collaborating with MDR/MSSP providers.
• Knowledge of EDR/endpoint protection and cloud security posture management.
• Experience developing incident response playbooks and runbooks.
• Understanding of Zero Trust principles in security operations.
• Familiarity with NIST, CIS Controls, ISO 27001, GDPR.
• Security automation/orchestration concepts for detection/response.
• Experience with Active Directory/Entra ID and identity signals in investigations.
• Ability to manage multiple incidents and projects in a dynamic environment.
• Knowledge of backup/disaster recovery tooling and processes.
• Experience with phishing simulation administration.

Responsibilities

• Monitor, triage, and investigate security events across AirLife’s environment.
• Lead incident response activities and coordinate post-incident reviews.
• Improve detection rules and runbooks to reduce false positives.
• Operate and integrate SIEM, EDR, and cloud security tools.
• Develop incident response playbooks and standard operating procedures.
• Collaborate with Arctic Wolf on alert tuning and investigations.
• Coordinate remediation across Infrastructure, Cloud, IT, and Apps teams.
• Support vulnerability management and remediation tracking.
• Track security metrics for leadership reporting.
• Participate in on-call rotations for after-hours response.
• Support KnowBe4 administration with the GRC team.
• Contribute to backup and DR operations as part of recovery.

Skills

SIEM platforms

Incident response leadership

Detection engineering

EDR/endpoint protection

Playbooks & runbooks

Zero Trust concepts

Security compliance (NIST/GDPR/ISO)

Automation/orchestration

Identity & access management (AD/Entra

On-call incident handling

Backup/disaster recovery

Phishing simulation (KnowBe4)

Education

Bachelor’s Degree in Cybersecurity/IT/CS

Security operations/incident response certs (CompTIA Security+ etc)

Tools

SIEM

EDR

Vulnerability management

Cloud security tooling

KnowBe4 security awareness

Rubrik/Azure DR

Job description

AirLife is seeking a Security Engineer for Security Operations & Incident Response to monitor, triage, and investigate security events globally. You will lead incident response, containment, and recovery while maturing detection, alert quality, and automation across SIEM, EDR, and cloud tooling.

Required 3–5 years in IT with 2+ years in security operations. Bachelor’s in a related field and relevant certifications are preferred. Travel up to 10% may apply.