Senior SOC Incident Response & Threat Hunter

OneMain Financial; Washington (District of Columbia); On-site; USD 140,000 - 190,000; Full time

Job summary

OneMain Financial seeks a senior cybersecurity professional to lead advanced investigations and drive the full incident response lifecycle across on‑premises and cloud environments. You will analyze Windows/Linux infrastructure, AD/AD CS, Microsoft Entra ID, and hybrid cloud platforms, delivering forensics, detections, and proactive threat hunting.

Applicants should have 8+ years of experience in security operations, deep knowledge of MITRE ATT&CK, and mastery of Elastic Security, Defender

Qualifications

• Expert knowledge of SIEM, SOAR, EDR/XDR, NDR, IDS/IPS, and cloud security technologies.
• Extensive hands-on experience with Elastic Security, Defender suites, and CrowdStrike.
• Strong understanding of Windows/Linux, AD, cloud services, containers, and hybrid clouds.
• Proven ability to lead complex enterprise incident investigations and perform advanced forensics.

Responsibilities

• Lead advanced investigations involving ransomware, APTs, and data exfiltration.
• Perform full lifecycle incident response including detection, triage, containment, and recovery.
• Investigate attacks across on‑premises and cloud environments, AD, AWS, Azure, and SaaS platforms.
• Perform forensic analysis of systems, endpoints, VMs, and network devices.
• Analyze telemetry from EDR/XDR, SIEM, firewalls, proxies, and cloud logs.
• Develop detections and SIEM correlation rules using ELK, KQL, SQL, PowerShell, and Python.
• Conduct proactive threat hunting using MITRE ATT&CK and threat intelligence.
• Provide technical leadership and mentoring to Tier 1 and Tier 2 analysts.
• Produce technical reports detailing timelines, root cause, IOCs, IOAs, and recommendations.

Skills

Threat hunting

Incident response leadership

Technical reporting

Post-incident analysis

Education

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or equivalent experience

Tools

ELK (Elastic Security)

CrowdStrike Falcon

Microsoft Defender XDR / Defender suite

KQL

SQL

PowerShell

Python

Bash

Job description

OneMain Financial seeks a senior cybersecurity professional to lead advanced investigations and drive the full incident response lifecycle across on‑premises and cloud environments. You will analyze Windows/Linux infrastructure, AD/AD CS, Microsoft Entra ID, and hybrid cloud platforms, delivering forensics, detections, and proactive threat hunting.

Applicants should have 8+ years of experience in security operations, deep knowledge of MITRE ATT&CK, and mastery of Elastic Security, Defender