Senior Cybersecurity Incident Response Engineer

GM Financial; Irving (TX); Hybrid; USD 120,000 - 170,000; Full time

Benefits offered by this job

401K matching

Tuition assistance

GM employee discount

Job summary

GM Financial is seeking a Sr Cybersecurity Engineer – Incident Response to lead detection, investigation, and response to complex threats across cloud and on‑prem environments. You will drive incident response activities and enhance security monitoring with a direct line to executive leadership.

The role requires hands‑on IR expertise, strong communication, and the ability to develop repeatable playbooks while coordinating across teams on security improvements.

Qualifications

• Experience in incident investigations across detection, containment, eradication, recovery, and post‑incident reviews.
• Knowledge of log analysis, SIEM alerts, IDS/IPS, and network traffic analysis.
• Experience translating investigations into repeatable response processes and playbooks.

Responsibilities

• Lead incident investigations and response efforts for complex threats.
• Analyze logs, SIEM alerts, IDS/IPS, and network traffic for suspicious activity.
• Act as senior escalation point for investigations and response strategy.
• Develop and standardize IR playbooks for consistency and efficiency.
• Identify attacker TTPs and IOCs; feed detections pipelines and playbooks.
• Stay updated on threat techniques and refine cloud detections in Azure and M365.

Skills

TCP/IP networking

NIST/ATT&CK

Incident response

Windows/Linux

Cloud IR (Azure)

Scripting (PowerShell/Python)

Communication

Documentation

Teamwork

Threat intelligence

Education

High School Diploma

Bachelor’s Degree or equivalent

Tools

Zeek

Suricata

Splunk

Azure

PowerShell

Python

Job description

GM Financial is seeking a Sr Cybersecurity Engineer – Incident Response to lead detection, investigation, and response to complex threats across cloud and on‑prem environments. You will drive incident response activities and enhance security monitoring with a direct line to executive leadership.

The role requires hands‑on IR expertise, strong communication, and the ability to develop repeatable playbooks while coordinating across teams on security improvements.