Senior Incident Response Lead & Forensics Expert

Advance Auto Parts Inc.; West Virginia; Hybrid; USD 140,000 - 190,000; Full time

Job summary

Advance Auto Parts Inc. is seeking a Principal Security Engineer, Incident Response to lead investigations and containment of high-severity cybersecurity incidents across the enterprise.

You will partner with Cybersecurity, Technology, Legal, Privacy, Risk Management, Store Operations, and Supply Chain to protect operations and minimize risk. As a senior technical individual, you will guide response from detection to closure, perform advanced forensics, and help mature IR playbooks.

Qualifications

• 6+ years of cybersecurity experience, with incident response focus.
• Proven leadership of high-severity cyber incidents.
• Hands-on host, network, memory, and cloud forensics.
• Experience with MITRE ATT&CK and NIST frameworks.
• Scripting ability (Python/PowerShell) to support investigations.

Responsibilities

• Lead technical response to high-severity cybersecurity incidents from detection through closure.
• Serve as technical lead during major cybersecurity events.
• Investigate ransomware, BEC, cloud compromise, identity-based attacks, and third-party breaches.
• Perform host, network, memory, log, and cloud forensic analysis to determine root cause, scope, and impact.
• Execute containment, eradication, and recovery actions in coordination with Technology and business teams.
• Preserve evidence and maintain chain of custody for legal and regulatory needs.
• Escalation point for junior incident responders on complex security events.
• Produce incident documentation and status updates for leadership.

Skills

Incident response

Digital forensics

Threat hunting

Scripting (Python/PowerShell)

Tools

SIEM

SOAR

EDR

Cloud security tools

Forensic analysis tools

Job description

Advance Auto Parts Inc. is seeking a Principal Security Engineer, Incident Response to lead investigations and containment of high-severity cybersecurity incidents across the enterprise.

You will partner with Cybersecurity, Technology, Legal, Privacy, Risk Management, Store Operations, and Supply Chain to protect operations and minimize risk. As a senior technical individual, you will guide response from detection to closure, perform advanced forensics, and help mature IR playbooks.