Senior IT Security Engineer

Koud; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

KOUD is seeking a Senior IT Security Engineer – Incident Response to lead the regional incident lifecycle across the Americas, coordinating with the global Cyber Defense Center. You will oversee triage, containment, recovery, forensics, and stakeholder communications, aligning with global standards and regional realities in a dynamic client environment.

You will mentor junior responders, contribute to playbooks, and drive continuous improvements to tooling and procedures in this security

Qualifications

• Experience in cybersecurity incident response and post-incident analysis.
• Hands-on digital forensics including evidence handling and chain of custody.
• Experience with SIEM platforms and enterprise security workflows.
• Broad knowledge of Windows, Linux/UNIX, networks, cloud services, and security controls.

Responsibilities

• Serve as the primary incident contact between Americas IT Ops and the Global Cyber Defense Center.
• Coordinate triage, containment, eradication, recovery and post-incident reviews.
• Manage the regional incident lifecycle from detection to closure with global alignment.
• Communicate findings clearly to technical and executive audiences.
• Develop understanding of regional environments, risks and dependencies.
• Handle digital evidence in a forensically sound manner and preserve chain of custody.
• Analyze security data across Windows, Linux/UNIX, cloud, network, email, and endpoints.
• Monitor AI-enabled attack techniques and defensive capabilities.
• Contribute to incident response playbooks, runbooks and SOPs.
• Mentor junior responders and share knowledge across the team.

Skills

Incident response

Forensics

SIEM

Threat intel

Automation scripting

Communication

Leadership

English fluency

Tools

SIEM platforms

Security monitoring tools

Cloud platforms (AWS/Azure)

Email/ticketing systems

Forensic tooling

Job description

Koud is looking for a Senior IT Security Engineer – Incident Response to work with one of our clients.The position focuses on serving as the primary point of contact between the Americas IT Operations teams and the global Cyber Defense Center, coordinating the entire security incident lifecycle across the region. The professional will be responsible for leading triage, containment, recovery, forensic analysis, stakeholder communication, and continuous improvement activities, aligning global response standards with the regional operational context and strengthening readiness against traditional and AI-enabled cyber threats.

Key Responsibilities

• Serve as the primary point of contact between the Americas IT Operations teams and the global Cyber Defense Center for security incident management activities;
• Coordinate incident triage, containment, eradication, recovery, escalation, and post-incident reviews for events affecting Americas IT assets;
• Manage the regional incident lifecycle from detection through closure, ensuring alignment with global processes and identifying regional operational gaps;
• Maintain clear, consistent, and timely communication with technical teams, regional stakeholders, senior management, and executive audiences;
• Develop a detailed understanding of regional organizations, business units, technology environments, operational workflows, risks, and dependencies;
• Handle digital evidence in a forensically sound manner, preserving chain of custody, integrity, and documentation standards;
• Perform security analysis and digital forensics across Windows, Linux or UNIX, cloud, network, email, endpoint, and enterprise environments;
• Analyze alerts, logs, threat intelligence, tickets, and reports from multiple sources, including SIEM and security operations platforms;
• Prepare investigation findings, incident briefings, risk assessments, and post-incident reports for technical and non-technical audiences;
• Monitor AI-enabled attack techniques and defensive capabilities, including deepfakes, automated phishing, adversarial machine learning, response automation, and AI-assisted threat intelligence;
• Contribute to the development and improvement of incident response playbooks, runbooks, standard operating procedures, tools, and service improvement initiatives;
• Mentor junior incident responders and share knowledge across the regional security team.

Requirements

• Strong experience in cybersecurity incident response, security operations, incident coordination, containment, recovery, and post-incident analysis;
• Hands-on knowledge of digital forensics, evidence handling, chain of custody, log analysis, threat intelligence, and investigative documentation;
• Experience with SIEM platforms, security monitoring tools, email and ticketing systems, as well as enterprise security operations workflows;
• Broad knowledge of enterprise technologies, including Windows, Linux or UNIX, directory services, AWS, Azure, mobile device management, virtualization, networks, web servers, databases, and firewalls;
• Proficiency in at least one programming or scripting language, such as Python, PowerShell, or Bash;
• Understanding of security control development, security operations, security risk management, and enterprise security governance;
• Familiarity with AI and machine learning concepts related to cyber threats, detection, response automation, and defensive technologies;
• Strong analytical thinking, problem-solving, prioritization, and decision-making skills during high-impact incidents;
• Excellent written and verbal communication skills, including the ability to brief senior management and executive stakeholders;
• Ability to collaborate effectively across different organizational structures, cultures, and geographic regions;
• Fluent English, both written and spoken;
• Proven experience collaborating with international and multicultural teams.

Preferred Qualifications

• CISSP, GCIH or another GIAC certification, CISA, CISM, CompTIA CySA+, or an equivalent cybersecurity certification;
• Experience with cloud incident response and cloud-native security tools in AWS or Azure environments;
• Knowledge of enterprise security governance frameworks and global information security policies;
• Knowledge of privacy and regulatory requirements across the Americas, including Brazil's LGPD, US state privacy laws, and Canadian privacy regulations;
• Relevant training or certification in AI or machine learning security;
• Knowledge of Spanish or Portuguese, in addition to English.