Senior DFIR Engineer: AI-Driven Incident Response & Forensics

Intuit, Inc.; Frisco (TX); On-site; USD 140,000 - 190,000; Full time

Job summary

Intuit is seeking a Senior Security Engineer to strengthen our DFIR team within the SOC. You will lead incident response efforts, perform advanced forensic investigations, and drive threat hunting across cloud and endpoint environments.

You will work with AI/LLM risk management, tune detections, and develop playbooks while collaborating with Compliance, Legal, and Risk teams. Strong communication and autonomous work style are required.

Qualifications

• Minimum 3–5 years in a dedicated cybersecurity role with DFIR focus.
• Experience creating and executing threat-hunting campaigns across endpoints, cloud, and network telemetry.
• Strong knowledge of incident response lifecycle and playbooks.
• Experience with AI/LLM security risks and governance frameworks.
• Familiarity with OWASP, MITRE ATT&CK, NIST, and CIS controls.

Responsibilities

• Oversee and promptly respond to escalated security events or investigations, and activate the Security Incident Response Plan as required.
• Provide on-call support for critical severity issues, manage communications, and report incident status to stakeholders.
• Lead forensic analysis and investigations to determine root cause, scope, and impact.
• Investigate AI/LLM tool incidents, extend IR playbooks for AI risks.
• Develop and maintain incident response plans, procedures, and playbooks for swift action and compliance.
• Leverage AI SOC platforms to accelerate triage, detection tuning, investigation, and documentation.
• Present guidance and training on security best practices to organizational partners.
• Mentor incident responders on handling techniques, cloud forensics, and best practices.
• Collaborate with Compliance, Legal, and Risk to align IR with regulatory needs.
• Assess vulnerabilities and propose remediation strategies; stay updated on threats.

Skills

Incident response

Digital forensics

Threat hunting

Cloud security

SIEM

AWS

Azure

GCP

Splunk

LogScale

CrowdStrike Falcon

Wiz

Python

Bash

PowerShell

MITRE ATT&CK

NIST

OWASP Top 10 for LLM

Education

Bachelor's degree or higher in Technology, CS, Cybersecurity

Certifications such as AWS Security Specialty, GCIH, GCFA, GFCE, CISSP

Tools

CrowdStrike Falcon

Wiz

Splunk

LogScale

Job description

Intuit is seeking a Senior Security Engineer to strengthen our DFIR team within the SOC. You will lead incident response efforts, perform advanced forensic investigations, and drive threat hunting across cloud and endpoint environments.

You will work with AI/LLM risk management, tune detections, and develop playbooks while collaborating with Compliance, Legal, and Risk teams. Strong communication and autonomous work style are required.