Senior Cyber Incident Response Engineer

Acrisure; Atlanta (GA); On-site; USD 120,000 - 180,000; Full time

Job summary

Acrisure is seeking a Security Incident Response Engineer to detect, investigate, contain, eradicate, and recover from cybersecurity incidents across our global environment. You will collaborate with Security Operations, Infrastructure, Cloud, IAM, and Legal to rapidly respond and reduce risk.

You will perform incident triage, containment, forensic analysis, threat hunting, and develop runbooks and automation to shorten response times while strengthening detection fidelity.

Qualifications

• Bachelor's degree in Computer Science, Information Security, Cybersecurity, or related discipline (or equivalent experience).
• Minimum 3 years of progressive information security experience.
• Strong understanding of incident response methodologies, attack lifecycle, and containment strategies.
• Experience with one or more EDR platforms such as Microsoft Defender for Endpoint, SentinelOne, CrowdStrike, or equivalent.
• Experience with SIEM technologies such as Microsoft Sentinel, Google SecOps, Splunk, QRadar, or similar platforms.
• Knowledge of Microsoft 365, Entra ID, Active Directory, and cloud security concepts.
• Understanding of MITRE ATT&CK, threat intelligence, and threat hunting methodologies.
• Familiarity with Windows, Linux, and macOS operating systems.
• Ability to analyze logs, indicators of compromise (IOCs), and attacker techniques.
• Experience with PowerShell, Python, KQL, or other scripting/query languages.

Responsibilities

• Investigate and respond to cybersecurity incidents involving endpoints, identities, cloud platforms, email systems, applications, data, and network infrastructure.
• Perform incident triage, severity classification, impact analysis, containment, eradication, and recovery activities.
• Execute cyber incident response procedures and escalation processes in accordance with the Cyber Incident Response Plan (CIRP).
• Coordinate response efforts across Security, Infrastructure, Cloud, IAM, Workplace Technology, Legal, Privacy, Human Resources, and business teams.
• Support major incident management activities and provide technical leadership during active security events.
• Maintain detailed incident records, timelines, evidence, findings, and lessons learned.
• Analyze alerts from EDR, SIEM, MDR, email security, cloud security, deception, and threat intelligence platforms.
• Validate suspicious activity to distinguish true incidents from false positives.
• Perform root cause analysis to identify attack vectors and attacker activities.
• Conduct proactive threat hunting to identify indicators of compromise and emerging threats.
• Leverage MITRE ATT&CK techniques to improve detection and investigative effectiveness.

Skills

Incident response

Threat hunting

Digital forensics

Root-cause analysis

Cross-functional collaboration

Education

Bachelor's degree in CS/IS/Cybersecurity or related

Tools

Microsoft Defender for Endpoint

SentinelOne

CrowdStrike

Microsoft Sentinel

Splunk

QRadar

KQL

PowerShell

Python

Job description

Acrisure is seeking a Security Incident Response Engineer to detect, investigate, contain, eradicate, and recover from cybersecurity incidents across our global environment. You will collaborate with Security Operations, Infrastructure, Cloud, IAM, and Legal to rapidly respond and reduce risk.

You will perform incident triage, containment, forensic analysis, threat hunting, and develop runbooks and automation to shorten response times while strengthening detection fidelity.