Senior Security Detection & Incident Lead

k2spacecorporation; Los Angeles (CA); On-site; USD 140,000 - 210,000; Full time

Job summary

K2 is seeking a senior security operations professional to own detection and response for our corporate environment. You will manage the SIEM, build detections against MITRE ATT&CK, and drive incidents from detection through containment and lessons learned.

Ideal candidates have 10+ years in security operations, hands-on SIEM experience, and a track record leading end-to-end incidents in fast-paced settings.

Qualifications

• 10+ years of experience in security operations, detection and response, or incident response.
• Hands-on experience administering and tuning a SIEM (e.g., Splunk, Microsoft Sentinel, Elastic, Panther, or Chronicle).
• Demonstrated experience leading security incidents end to end, from detection and scoping through containment, eradication, and post-incident review.
• Strong working knowledge of attacker tactics, techniques, and procedures (TTPs), the MITRE ATT&CK framework, and the evidence sources needed to investigate them.
• Experience investigating endpoint, identity,

Responsibilities

• Own day-to-day detection and response across the corporate environment, from alert triage and investigation through containment and remediation
• Administer and mature the SIEM, including log source onboarding, parsing and normalization, telemetry enrichment, rule tuning, and platform health, retention, and cost
• Write, test, and maintain detection content mapped to MITRE ATT&CK using detection-as-code practices, including version control, peer review, and automated testing
• Act as incident commander for corporate security incidents, coordinating stakeholders and delivering timelines, root cause analysis, and post-incident follow-through
• Build response playbooks and automation across SOAR, scripting, and vendor APIs to reduce time to detect, triage, and contain
• Threat hunt proactively across endpoint, identity, SaaS, and cloud telemetry using threat intelligence and hypotheses about adversary behavior
• Run adversary emulation and purple team exercises to validate detection coverage, then close the gaps you find
• Perform host, network, and cloud forensics across macOS, Windows, and Linux to reconstruct attacker activity and scope impact
• Investigate phishing, business email compromise, credential abuse, and insider risk in partnership with IT, HR, and Legal
• Partner with IT and infrastructure teams to harden identity, endpoint, and network controls, including conditional access, EDR policy, MDM baselines, segmentation, and secure remote access, informed by what investigations reveal
• Translate detection and incident findings into vulnerability management priorities and security architecture improvements
• Participate in an on-call rotation for security escalations, including occasional after-hours and weekend response
• Maintain runbooks, detection documentation, and standard operating procedures, and mentor junior team members on investigation and response tradecraft
• Support compliance and audit efforts by producing monitoring, detection, and incident response evidence as needed

Skills

Security operations

Incident response

MITRE ATT&CK

Threat hunting

Tools

Splunk

Microsoft Sentinel

Elastic

Panther

Chronicle

Job description

K2 is seeking a senior security operations professional to own detection and response for our corporate environment. You will manage the SIEM, build detections against MITRE ATT&CK, and drive incidents from detection through containment and lessons learned.

Ideal candidates have 10+ years in security operations, hands-on SIEM experience, and a track record leading end-to-end incidents in fast-paced settings.