Senior Incident Response Engineer — IR Lead (Hybrid)

GM Financial; Arlington (TX); Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

401K matching

Tuition assistance

GM employee auto discount

Company holidays

Job summary

GM Financial seeks a Sr Cybersecurity Engineer – Incident Response to lead detection, investigation, and response to complex threats across cloud and on-prem environments. You will drive advanced IR activities and enhance security monitoring with a direct line to executive leadership.

The role includes developing IR playbooks, refining detections for Azure and Microsoft 365, and participating in on-call rotations.

Qualifications

• Knowledge of TCP/IP, OSI model, and subnetting.
• Experience with log analysis tools like Bro/Zeek or Suricata.
• Familiarity with NIST Incident Response Life Cycle and MITRE ATT&CK.
• Experience with Windows, Linux/Unix, and Mac OS.
• Cloud incident response on Azure.
• Hands-on IR in cloud and on-prem environments.
• Experience writing Splunk queries for investigations.
• Automation to acquire evidence and investigate at scale.
• Ability to communicate across stakeholders.

Responsibilities

• Lead incident investigations from detection to containment, eradication, and recovery.
• Analyze logs, SIEM alerts, IDS/IPS alerts, host activity, and network traffic for threats.
• Serve as senior escalation point for complex investigations and guide response strategy.
• Develop and standardize incident response playbooks to improve consistency.
• Identify attacker TTPs and IOCs; feed them into detection pipelines and IR playbooks.
• Stay current with attack techniques and refine cloud detections in Azure and M365.
• Participate in on-call rotation to support after-hours incidents.

Skills

TCP/IP networking

OSI model

Subnetting

Bro/Zeek

MITRE ATT&CK

Azure

Windows

Scripting

Cloud IR

Investigation leadership

Communication

Education

Bachelor's Degree in related field

High School Diploma

Tools

Splunk

Job description

GM Financial seeks a Sr Cybersecurity Engineer – Incident Response to lead detection, investigation, and response to complex threats across cloud and on-prem environments. You will drive advanced IR activities and enhance security monitoring with a direct line to executive leadership.

The role includes developing IR playbooks, refining detections for Azure and Microsoft 365, and participating in on-call rotations.