Senior SOC & Incident Response Engineer

SCIGON; Chicago (IL); On-site; USD 113,000 - 150,000; Full time

Job summary

SCIGON is seeking a Senior Security Operations & Incident Response Engineer in Chicago to advance our security operations program. You will own incident response investigations, develop playbooks, and drive detections and automation across hybrid cloud environments (GCP, Azure).

The role requires 5+ years in incident response, strong SIEM/SOAR experience, and proficiency in Python/PowerShell/Bash. Collaboration with cross-functional teams is essential to reduce risk and improve time-to-respond.

Qualifications

• Bachelor's degree and 5+ years in incident response and SOC tooling.
• Deep knowledge of SIEM/SOAR platforms and hybrid cloud environments (GCP, Azure).
• Experience leading incident response as Incident Commander.
• Scripting in Python, PowerShell, Bash, and XQL preferred.
• Understanding MITRE ATT&CK, NIST, and ISO frameworks.

Responsibilities

• Lead deep-dive investigations including memory, network, and malware analysis.
• Develop and refine incident response playbooks and guidelines.
• Build threat models and translate pen-test findings into detections.
• Design and tune detection rules and automated remediation workflows.
• Tune SIEM rules with the SOC team to maximize fidelity and reduce alerts.
• Review threat intel, brand protection, and dark web monitoring.
• Collaborate across teams and act as Incident Commander when needed.
• Proficiency in scripting and automation, with SOAR tooling.

Skills

Incident response

SOC tooling

Threat modeling

Scripting (Python)

XQL

SOAR automation

Communication

Education

Bachelor's degree

Tools

SIEM

SOAR

GCP

Azure

Job description

SCIGON is seeking a Senior Security Operations & Incident Response Engineer in Chicago to advance our security operations program. You will own incident response investigations, develop playbooks, and drive detections and automation across hybrid cloud environments (GCP, Azure).

The role requires 5+ years in incident response, strong SIEM/SOAR experience, and proficiency in Python/PowerShell/Bash. Collaboration with cross-functional teams is essential to reduce risk and improve time-to-respond.