Senior SIEM & Detection Engineer – Incident Response Lead

Faegre-Drinker-Biddle-; Philadelphia (Philadelphia County); Hybrid; USD 160,000 - 183,000; Full time

Benefits offered by this job

Hybrid work environment

Wellness programming

Health plan options

Dental and vision

401(k) plan

Paid time off

Job summary

Faegre Drinker Biddle & Reath LLP seeks a Senior Information Security Engineer – SIEM and Detection to support its Technology & Innovation team across Philadelphia, NYC, or DC. You will own the firm’s SIEM platform, onboard log sources, and design detection rules aligned with MITRE ATT&CK.

You will lead IR activities, maintain IR playbooks, and coordinate with CrowdStrike and other security tools to strengthen monitoring and response capabilities for client confidentiality and regulatory needs.

Qualifications

• Bachelor's degree in cybersecurity or related field or equivalent experience.
• 8+ years in information security with security operations and IR.
• Hands-on SIEM engineering: log onboarding, parsing, normalization.
• Experience tuning detections with MITRE ATT&CK awareness.
• Proven leadership in incident response and playbooks.

Responsibilities

• Own SIEM architecture, config, health and cost management with partners.
• Onboard log sources across Defender, Entra ID, 365, Purview, CrowdStrike.
• Design and tune detection rules mapped to MITRE ATT&CK.
• Lead Security Incident Response Team investigations and recovery.
• Maintain Incident Response Plans and run tabletop exercises.
• Configure CrowdStrike Falcon across endpoints and identities.

Skills

SIEM engineering

Detections tuning

EDR configuration

Incident response

Managed services liaison

Microsoft security tooling

MITRE ATT&CK knowledge

KQL queries

Education

Bachelor's degree in cybersecurity or related field

Tools

CrowdStrike Falcon

Microsoft Defender

Microsoft Entra ID

Microsoft 365

Microsoft Purview

Job description

Faegre Drinker Biddle & Reath LLP seeks a Senior Information Security Engineer – SIEM and Detection to support its Technology & Innovation team across Philadelphia, NYC, or DC. You will own the firm’s SIEM platform, onboard log sources, and design detection rules aligned with MITRE ATT&CK.

You will lead IR activities, maintain IR playbooks, and coordinate with CrowdStrike and other security tools to strengthen monitoring and response capabilities for client confidentiality and regulatory needs.