Senior Security Engineer - Digital Forensics and Incident Response (DFIR)

Intuit; Frisco (TX); On-site; USD 140,000 - 190,000; Full time

Job summary

Intuit is seeking a Senior Security Engineer to strengthen our DFIR team within the SOC. You will lead incident response efforts, perform advanced forensic investigations, and drive threat hunting across cloud and endpoint environments.

You will work with AI/LLM risk management, tune detections, and develop playbooks while collaborating with Compliance, Legal, and Risk teams. Strong communication and autonomous work style are required.

Qualifications

• Minimum 3–5 years in a dedicated cybersecurity role with DFIR focus.
• Experience creating and executing threat-hunting campaigns across endpoints, cloud, and network telemetry.
• Strong knowledge of incident response lifecycle and playbooks.
• Experience with AI/LLM security risks and governance frameworks.
• Familiarity with OWASP, MITRE ATT&CK, NIST, and CIS controls.

Responsibilities

• Oversee and promptly respond to escalated security events or investigations, and activate the Security Incident Response Plan as required.
• Provide on-call support for critical severity issues, manage communications, and report incident status to stakeholders.
• Lead forensic analysis and investigations to determine root cause, scope, and impact.
• Investigate AI/LLM tool incidents, extend IR playbooks for AI risks.
• Develop and maintain incident response plans, procedures, and playbooks for swift action and compliance.
• Leverage AI SOC platforms to accelerate triage, detection tuning, investigation, and documentation.
• Present guidance and training on security best practices to organizational partners.
• Mentor incident responders on handling techniques, cloud forensics, and best practices.
• Collaborate with Compliance, Legal, and Risk to align IR with regulatory needs.
• Assess vulnerabilities and propose remediation strategies; stay updated on threats.

Skills

Incident response

Digital forensics

Threat hunting

Cloud security

SIEM

AWS

Azure

GCP

Splunk

LogScale

CrowdStrike Falcon

Wiz

Python

Bash

PowerShell

MITRE ATT&CK

NIST

OWASP Top 10 for LLM

Education

Bachelor's degree or higher in Technology, CS, Cybersecurity

Certifications such as AWS Security Specialty, GCIH, GCFA, GFCE, CISSP

Tools

CrowdStrike Falcon

Wiz

Splunk

LogScale

Job description

Overview

We are seeking an experienced Senior Security Engineer to join our Digital Forensics and Incident Response (DFIR) team within the broader Security Operations Center (SOC), to help our organization respond to cyber-attacks. The ideal candidate will have a deep understanding of the security incident response and incident management process, attacker kill chains / methodologies, be able to respond quickly to attacks, restore services, and forensically investigate the root cause. They will also help defend against emerging AI and agentic system risks, tune detections, and build out threat hunting capabilities. As a member of our SOC, you will closely collaborate with other engineers to design and implement solutions, improve incident response readiness, and provide guidance and training to external teams.

Overview

We are seeking an experienced Senior Security Engineer to join our Digital Forensics and Incident Response (DFIR) team within the broader Security Operations Center (SOC), to help our organization respond to cyber-attacks. The ideal candidate will have a deep understanding of the security incident response and incident management process, attacker kill chains / methodologies, be able to respond quickly to attacks, restore services, and forensically investigate the root cause. They will also help defend against emerging AI and agentic system risks, tune detections, and build out threat hunting capabilities. As a member of our SOC, you will closely collaborate with other engineers to design and implement solutions, improve incident response readiness, and provide guidance and training to external teams.

Responsibilities

• Oversee and promptly respond to escalated security events or investigations, and activate the Security Incident Response Plan as required.
• Provide on-call support for critical severity issues, manage communications, and report incident status to the appropriate stakeholders.
• Lead forensic analysis and conduct investigations to ascertain the root cause, scope, and impact of security incidents.
• Investigate and respond to incidents involving AI/LLM-based tools and agentic platforms, such as data leakage, insecure output handling, and unauthorized model access, and extend IR playbooks to cover generative AI and AI SOC platform risks.
• Develop, maintain, and improve incident response plans, procedures, and playbooks to ensure swift action and regulatory compliance.
• Leverage AI SOC platforms and frontier AI tools to accelerate triage, detection tuning, investigation, and documentation, and help evaluate new AI capabilities as they are onboarded.
• Present guidance and training on security best practices and incident response to organizational partners, while ensuring alignment with business objectives and compliance requirements.
• Mentor and train incident responders on incident handling techniques, forensic analysis, and cloud security forensics and best practices.
• Collaborate with Compliance, Legal, and Risk teams to integrate incident response operations with business and regulatory needs.
• Assess vulnerabilities, propose remediation strategies, and keep up-to-date on current and emerging security trends, threats, and countermeasures.
  

Qualifications

• A Bachelor's degree or higher in Technology, Computer Science, Cybersecurity, or a related field, or equivalent hands‑on experience, is preferred.
• Possession of industry‑recognized professional certifications such as AWS Security Specialty, GCIH, GCFA, GFCE, CISSP, or emerging AI security credentials is advantageous.
• 3-5 years of experience in a dedicated cybersecurity role, with a strong emphasis on digital forensics and incident response.
• 1-3 years writing scripts or code (Bash, PowerShell, Python) to automate security work, comfortable using AI coding assistants and AI SOC platforms to build faster, and aware of the risks that come with AI‑generated code.
• Working knowledge of AI/LLM security risks and mitigations, such as data exfiltration, insecure output handling, model and data supply chain risk, and shadow AI usage, and familiarity with frameworks such as the OWASP Top 10 for LLM Applications, MITRE ATLAS, and NIST AI RMF.
• Experience performing analysis and detection engineering using Endpoint Detection and Response or Cloud Security Posture Management tools such as CrowdStrike Falcon, and Wiz.
• Proven threat hunting experience, developing and executing hypothesis‑driven hunts across endpoint, cloud, and network telemetry to uncover threats that evade existing detections.
• Comprehensive understanding of cybersecurity, networking and cloud fundamentals, and frameworks such as OWASP, MITRE ATT&CK, NIST, and CIS.
• Experience using and defending Public Cloud services such as AWS, Azure, and GCP (IAM, CI/CD Pipelines, Network Security, DLP).
• Deep understanding of Security Information and Event Management (SIEM) solutions such as Splunk, LogScale.
• Strong analytical and problem‑solving abilities, with a focus on identifying root causes and assessing risk exposure.
• Exceptional communication skills, both verbal and written, capable of explaining technical details to non‑technical audiences and fostering strong stakeholder relationships.
• Self‑motivated with the ability to work autonomously, managing tasks effectively and seeking assistance when necessary.
• Proficient in working under pressure in a dynamic environment, prioritizing tasks to meet tight deadlines while maintaining procedural discipline.
• Profound knowledge of digital forensics technologies and methodologies, as well as expertise in the Security Incident Response Lifecycle according to frameworks like NIST or SANS.
• Adaptable and proactive attitude, willing to take on various responsibilities and eager to continuously learn and upgrade skills.
  

If you have a passion for security and a proven track record in incident response and security operations, join our SOC and help us protect our organization and our customers from cyber-attacks.

Intuit provides a competitive compensation package with a strong pay for performance rewards approach. This position may be eligible for a cash bonus, equity rewards and benefits, in accordance with our applicable plans and programs (see more about our compensation and benefits at Intuit®: Careers | Benefits). Pay offered is based on factors such as job-related knowledge, skills, experience, and work location. To drive ongoing fair pay for employees, Intuit conducts regular comparisons across categories of ethnicity and gender.