Senior Endpoint Security Engineer

Barracuda; Illinois; On-site; USD 120,000 - 180,000; Full time

Job summary

Forensic Focus in Illinois is seeking an experienced incident responder to lead endpoint incident response engagements across multiple client environments. You will perform host-based forensics, evidence acquisition, and threat hunting, delivering clear client-facing reports.

You will map activity to MITRE ATT&CK, analyze Microsoft 365 compromises, and synthesize timelines to support remediation. Strong communication with clients is essential.

Qualifications

• 5+ years in incident response, digital forensics, or security operations.
• Experience in MSSP or MDR environments preferred.
• Hands-on forensic investigation and client communication.

Responsibilities

• Lead incident response engagements across multiple client environments.
• Perform host-based forensics and evidence acquisition.
• Threat hunting and reconstructing attack timelines.
• Map activity to MITRE ATT&CK and produce client-facing incident reports.

Skills

Incident response

Digital forensics

Security operations

Client communication

Tools

SentinelOne XDR

Binalyze AIR

Elastic

Databricks

Python

Tines

Job description

The Role

This role leads incident response engagements across multiple client environments, performing host-based forensics, evidence acquisition, and threat hunting. Responsibilities include investigating alerts, reconstructing attack timelines, mapping activity to MITRE ATT&CK, analysing Microsoft 365 compromises, and producing client-facing incident reports.

Skills & Experience

Requires expertise in SentinelOne XDR, Binalyze AIR for remote forensic triage, Elastic for log analysis, Databricks for large-scale analytics, and Python/Tines for automation. Candidates need 5+ years in incident response, digital forensics, or security operations, ideally within an MSSP or MDR environment.

Who It Suits

Suited to experienced incident responders comfortable with hands-on forensic investigation, client communication, and fast-paced multi-tenant environments, who enjoy combining technical analysis with advisory and reporting responsibilities.