Senior Security Incident Response & Operations Engineer

Tokio Marine Global Services; Boston (MA); On-site; USD 150,000 - 190,000; Full time

Job summary

Tokio Marine Global Services is seeking a Senior Incident Response/Operations Engineer to maintain security infrastructure, hunt threats, and respond to incidents within the Global Fusion Center US Operations. The role emphasizes automation, development of detection rules, and collaboration with security vendors and partner teams.

You will be responsible for proactive threat detection, incident handling, and improving security operations through metrics, automation, and clear communication

Qualifications

• 8+ years of experience in an operational cybersecurity role.
• 3+ years of hands-on incident response experience.
• Experience developing and delivering on incident and program status for leadership.
• Experience in threat hunting including leveraging intelligence data to proactively find and iteratively investigate suspicious behavior across networks and systems.
• Experience analyzing network and host-based security events.
• Proficient System Administration with either Microsoft Windows or Linux.
• Proficient with CLI shells such as PowerShell or bash.
• Proficient with Security Log infrastructure configuration such as Windows Event Forwarding (WEF) or syslog.
• Proficient in an interpreted language such as Python, Perl, or Ruby.
• Familiarity with regular expressions.
• Familiarity with Large Language Models tools such as Ollama.
• Knowledge of operating systems, file systems, and memory structures on Windows, MacOS and Linux.
• Knowledge of networking technologies, specifically TCP/IP and the related protocols.
• Understanding of networks, operating systems, and architecture and how they affect the security posture of a company.
• Strong problem-solving aptitude
• Demonstrated ownership of projects or tasks
• Strong verbal and written communication skills
• Demonstrated professionalism and a calm demeanor while dealing with complex or high-urgency situations

Responsibilities

• Conduct security investigations and lead security incident response in a cross-functional environment and drive incident resolution.
• Monitor security systems and infrastructure to support best performance and reliability.
• Implement and manage security tools and processes, to detect and mitigate threats.
• Maintain robust security feeds and ensure data integrity.
• Proactively look for threats working with level one analysts, affected teams and security vendors.
• Author threat detection rules and subsequent SOAR playbooks.
• Refine operational metrics, KPIs, and SLAs to measure Security Operations and Incident Response services.
• Identify and implement security process automation, continuously improving processes and tools.
• Be a technical subject matter expert for Security Operations and incident Response services.
• Provide expertise to partnered security teams in mitigation of those threats.
• Communicate complex technical information clearly and concisely to both technical and non-technical audiences.
• Collaborate with partner security teams to offer guidance and bolster support of the organization’s security infrastructure.
• Build, cultivate, and maintain positive relationships with internal customers to identify and facilitate solutions to increase the impact of the team's work.
• Influence and align the team’s vision and strategy.

Skills

Incident response

Threat hunting

Communication skills

Problem solving

Ownership

Security monitoring

Security operations

Team collaboration

Python/Perl/Ruby scripting

LLM tools familiarity

Tools

PowerShell

bash

Ollama

WEF / syslog

Job description

Tokio Marine Global Services is seeking a Senior Incident Response/Operations Engineer to maintain security infrastructure, hunt threats, and respond to incidents within the Global Fusion Center US Operations. The role emphasizes automation, development of detection rules, and collaboration with security vendors and partner teams.

You will be responsible for proactive threat detection, incident handling, and improving security operations through metrics, automation, and clear communication