Senior Incident Response Lead & Threat Hunter

Advance Auto Parts Inc.; Raleigh (NC); Hybrid; USD 140,000 - 180,000; Full time

Benefits offered by this job

Health & wellness benefits

Job summary

Advance Auto Parts, Inc. is seeking a Principal Security Engineer, Incident Response to lead investigations and containment of major security incidents across the enterprise.

You will serve as a technical lead during incidents, coordinating with cross-functional teams to ensure thorough analysis and rapid remediation while minimizing business impact. The role requires hands-on experience with SIEM, SOAR, EDR, cloud security, and forensics, plus strong scripting and communication skills to

Qualifications

• 6+ years of cybersecurity experience with 3+ years in incident response or digital forensics.
• Proven experience leading investigations of ransomware, BEC, cloud and identity-based attacks.
• Hands-on with security tech including SIEM, SOAR, EDR, and cloud security tools.

Responsibilities

• Lead technical response to high-severity cybersecurity incidents from detection through closure.
• Act as technical lead during major cybersecurity events and coordinate with Incident Commander.
• Investigate ransomware, malware outbreaks, BEC, credential theft, cloud breaches, insider threats, and third-party breaches.
• Perform host, network, memory, log, and cloud forensic analysis to determine root cause and scope.
• Execute containment, eradication, and recovery actions with Technology and business teams.
• Preserve evidence and maintain chain of custody for regulatory and legal needs.
• Mentor junior responders and produce incident documentation for leadership.

Skills

SIEM/SOAR/EDR

Cloud security tools

Forensic analysis

Windows / Linux

Active Directory / Entra ID

MITRE ATT&CK

Python / PowerShell

Incident response leadership

Communication skills

Tools

AWS/Azure/GCP

Forensic tooling

Job description

Advance Auto Parts, Inc. is seeking a Principal Security Engineer, Incident Response to lead investigations and containment of major security incidents across the enterprise.

You will serve as a technical lead during incidents, coordinating with cross-functional teams to ensure thorough analysis and rapid remediation while minimizing business impact. The role requires hands-on experience with SIEM, SOAR, EDR, cloud security, and forensics, plus strong scripting and communication skills to