Senior Incident Response Engineer: Lead Threat Containment

Archer; San Jose (CA); Hybrid; USD 144,000 - 180,000; Full time

Job summary

Archer is seeking a Senior Incident Response Engineer to lead Archer's detection and remediation efforts across SIEM, SOAR, and security platforms. You will serve as the primary technical liaison to our MSSP, translating alerts into actionable responses while ensuring compliance with NIST SP 800-171.

You will drive incident response from containment to recovery, coordinating cross-functional teams, developing playbooks, and advancing Archer's IR program strategy with regular updates to CISO and

Qualifications

• 5+ years in Incident Response or Security Operations (SOC).
• Experience investigating security incidents from detection through containment and eradication.
• Deep understanding of OS internals and network protocols; scripting for automation.
• Working knowledge of SIEM platforms and query languages to hunt threats.
• Hands-on experience with SOAR platforms to design automated workflows.
• Knowledge of Cyber Threat Intelligence standards and UEBA.
• Strong technical writing and security documentation skills.

Responsibilities

• Serve as Archer's primary internal SIEM engineer with MSSP collaboration.
• Lead technical response to validated incidents: containment, eradication, recovery.
• Conduct deep-dive forensics and produce incident reports for HR/legal/regulators.
• Perform proactive threat hunts using SIEM/EDR telemetry.
• Develop, validate custom detection rules mapped to MITRE ATT&CK.
• Design and maintain IR playbooks and SOAR workflows.
• Define log collection requirements and support audits (NIST 800-171 AU, CMMC).
• Manage endpoint detection policies and live response actions.
• Operationalize CTI feeds into detection logic.
• Own IR documentation architecture and runbooks for audit-readiness.
• Evolve IR program strategy, metrics, and roadmap for leadership.
• Provide tabletop exercise facilitation to IT and leadership.

Skills

Incident Response

SOC Operations

MSSP Management

Malware Analysis

Scripting

SIEM

SOAR

Threat Hunting

Forensics

Technical Writing

Tabletop Exercises

Cloud Security

Tools

Google Chronicle

Splunk

Microsoft Sentinel

Cortex XSOAR

Splunk Phantom

YARA-L

GoogleSQL

SPL

KQL

Job description

Archer is seeking a Senior Incident Response Engineer to lead Archer's detection and remediation efforts across SIEM, SOAR, and security platforms. You will serve as the primary technical liaison to our MSSP, translating alerts into actionable responses while ensuring compliance with NIST SP 800-171.

You will drive incident response from containment to recovery, coordinating cross-functional teams, developing playbooks, and advancing Archer's IR program strategy with regular updates to CISO and