Senior Security Operations & Incident Response Engineer

SCIGON; Chicago (IL); On-site; USD 113,000 - 150,000; Full time

Job summary

SCIGON is seeking a Senior Security Operations & Incident Response Engineer in Chicago to advance our security operations program. You will own incident response investigations, develop playbooks, and drive detections and automation across hybrid cloud environments (GCP, Azure).

The role requires 5+ years in incident response, strong SIEM/SOAR experience, and proficiency in Python/PowerShell/Bash. Collaboration with cross-functional teams is essential to reduce risk and improve time-to-respond.

Qualifications

• Bachelor's degree and 5+ years in incident response and SOC tooling.
• Deep knowledge of SIEM/SOAR platforms and hybrid cloud environments (GCP, Azure).
• Experience leading incident response as Incident Commander.
• Scripting in Python, PowerShell, Bash, and XQL preferred.
• Understanding MITRE ATT&CK, NIST, and ISO frameworks.

Responsibilities

• Lead deep-dive investigations including memory, network, and malware analysis.
• Develop and refine incident response playbooks and guidelines.
• Build threat models and translate pen-test findings into detections.
• Design and tune detection rules and automated remediation workflows.
• Tune SIEM rules with the SOC team to maximize fidelity and reduce alerts.
• Review threat intel, brand protection, and dark web monitoring.
• Collaborate across teams and act as Incident Commander when needed.
• Proficiency in scripting and automation, with SOAR tooling.

Skills

Incident response

SOC tooling

Threat modeling

Scripting (Python)

XQL

SOAR automation

Communication

Education

Bachelor's degree

Tools

SIEM

SOAR

GCP

Azure

Job description

Senior Security Operations & Incident Response Engineer

Salary: $112,500-$150,000

The Engineer - Security Operations and Incident Response will be a critical function responsible for the transformation of the organization's Security Operations and Incident Response program. With a focus on maintaining resilience and protecting the global enterprise from cybersecurity threats, we operate an advanced Security Operations and Incident Response program focused on the identification, analysis, and eradication of cybersecurity threats and incidents across the organization. In support of the continued growth of this critical program, we are seeking an experienced, passionate, and highly organized engineer who will drive operational delivery excellence and continuous advancement across processes and technologies.

• Provide expert-level support for deep-dive investigations, including digital forensics (memory, network, and malware analysis).
• Author and refine incident response playbooks and operational guidelines to ensure the team remains agile in an evolving threat landscape.
• Develop and maintain threat models, incorporating findings from penetration tests into detection strategies.
• Design, implement, and refine complex detection rules and automated remediation workflows to identify adversarial behavior.
• Utilize threat intelligence and the MITRE ATT&CK framework to identify gaps in visibility and proactively mitigate emerging risks.
• Maintain comprehensive documentation of detection strategies, active investigations, and incident response timelines.
• Work with the SIEM team to continuously tune SIEM rules to maximize detection fidelity while minimizing alert fatigue.
• Review and tune threat intelligence systems, including brand protection and dark web monitoring capabilities.
• Demonstrate proficiency in scripting and query building using Python, XQL, PowerShell, or Bash, and experience with automation and/or orchestration (SOAR) tools.
• Support Incident Response leadership as a backup for incident response-related activities.

• Bachelor's degree and 5+ years of relevant experience in incident response and SOC tooling.
• In-depth knowledge of SIEM/SOAR platforms and incident response processes in hybrid cloud environments (GCP, Azure).
• Experience leading incident response efforts as an Incident Commander, performing root cause analysis, and driving continuous optimization of SOC tools and processes.
• Familiarity with scripting languages such as Python, PowerShell, Bash, and XQL is highly preferred.
• Understanding of regulatory compliance requirements and cybersecurity frameworks such as MITRE ATT&CK, NIST, and ISO.
• Ability to prioritize tasks effectively, manage multiple competing priorities, and work both independently and collaboratively within a team.
• Strong communication skills with the ability to translate complex technical issues and concepts into clear, concise language for non-technical audiences while emphasizing business value.