Senior CTIR Engineer: Threat Intel & Incident Response

Xplor; Atlanta (GA); On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Paid parental leave

Diversity & Inclusion initiatives

Mental health support

Flexible working arrangements

Medical and life insurance

LinkedIn Learning access

Job summary

Xplor is seeking a Senior Cybersecurity Engineer to lead CTIR incident response across platforms and applications. You will triage, investigate, contain, eradicate and recover from security events, then report findings to engineering, IT and leadership.

The role emphasizes calm decision-making under pressure, ownership from alert to final report, and proactive threat hunting to strengthen detections and response playbooks.

Qualifications

• 3 to 6 years experience in security operations or incident response.
• Strong triage and root cause analysis with log correlation.
• Experience with a SIEM to investigate, hunt and build detections (Microsoft Sentinel preferred).
• Familiar with ITIL processes and standards such as ISO 27001 and PCI DSS.

Responsibilities

• Own incidents as part of the CTIR team: detect, triage, investigate, contain and eradicate.
• Lead investigations across systems, digging into logs, endpoints, email and network data.
• Perform host and network forensics, malware triage, and email analysis to understand attacker activity.
• Coordinate with engineering and wider security team during a response and communicate clearly to technical teams and leadership.
• Hunt proactively for threats and build new detections and indicators of compromise.

Skills

SIEM

EDR

Threat hunting

Incident response

KQL

PowerShell

Python

Tools

Microsoft Sentinel

Jupyter Notebooks

SOAR

Job description

Xplor is seeking a Senior Cybersecurity Engineer to lead CTIR incident response across platforms and applications. You will triage, investigate, contain, eradicate and recover from security events, then report findings to engineering, IT and leadership.

The role emphasizes calm decision-making under pressure, ownership from alert to final report, and proactive threat hunting to strengthen detections and response playbooks.