SOC/Incident Response Engineer

beneschlaw; Chicago (IL); Hybrid; USD 112,000 - 139,000; Full time

Job summary

beneschlaw is looking for a SOC/Incident Report Engineer to join our Chicago office. This hybrid role involves detecting, investigating, and responding to cybersecurity incidents while collaborating with cross-functional teams.

The ideal candidate should have 3-7 years of relevant experience and strong knowledge of security technologies including SIEM platforms and cloud security tools. This position offers a salary range of $112K to $139K per year.

Qualifications

• 3-7 years of experience in a SOC or incident response role.
• Strong technical foundation in networking and cloud architectures.
• Experience with SIEM platforms and EDR solutions.

Responsibilities

• Monitor security tools to identify suspicious activities.
• Perform incident triage and lead incident response activities.
• Conduct digital forensics on compromised systems.
• Investigate security events in cloud environments.
• Develop and maintain security automation workflows.

Skills

Cybersecurity Threat Detection

Digital Forensics

Cloud Security

Incident Response

Malware Analysis

Scripting (Python, PowerShell, KQL)

Education

3-7 years in Security Operations Center or related

Relevant security certifications (e.g., CISSP, GIAC)

Tools

Microsoft Sentinel

Splunk

CrowdStrike

Velociraptor

Job description

Benesch is proud to announce the opening for a SOC/Incident Report Engineer in our Chicago office. This position is hybrid with work‑from‑home flexibility.

Position Summary

Are you excited about detecting and resolving cybersecurity threats and incidents? Do you find it a challenge to help an organization reduce threats and enhance its security? Does working with teams to develop strategies to improve detection capabilities intrigue you? Then you may be interested in our SOC/Incident Report Engineer position. This role is perfect for the individual looking to play a crucial role in Benesch's security initiatives.

The SOC/Incident Response Engineer is responsible for detecting, investigating, and responding to cybersecurity incidents across the Firm. This role combines threat detection, digital forensics, malware triage, and cloud security expertise to protect organizational assets, reduce risk, and strengthen security posture. The engineer will operate within a 24/7 security operations environment, collaborating with cross‑functional teams to analyze threats, develop response strategies, and improve detection capabilities.

Position Responsibilities

• Security Monitoring & Threat Detection
  • Monitor SIEM, EDR, NDR, and cloud‑native security tools to identify suspicious activity and potential security incidents.
  • Create, tune, and optimize detection rules, correlation logic, and analytic use cases.
  • Conduct threat hunting based on emerging TTPs, threat intel, and anomaly patterns.
  • Maintain and improve alerting fidelity to reduce false positives and enhance detection precision.
• Incident Response & Triage
  • Perform initial triage of security alerts to assess severity, impact, and required response actions.
  • Lead full incident lifecycle activities including investigation, containment, eradication, recovery, and post‑incident analysis.
  • Coordinate with IT, cloud, and business teams to execute IR playbooks and minimize operational impact.
  • Document incidents, findings, and lessons learned; contribute to after‑action reviews.
• Digital Forensics & Malware Analysis
  • Conduct forensic acquisition and analysis of endpoints, servers, cloud resources, and network artifacts (disk, memory, logs).
  • Examine artifacts such as registry hives, event logs, file systems, network captures, browser history, and persistence mechanisms.
  • Perform malware triage (dynamic and static) to determine malware behavior, indicators of compromise, and propagation mechanisms.
  • Maintain chain‑of‑custody processes and ensure forensic data integrity for potential legal or compliance requirements.
• Cloud Security & IR
  • Monitor and respond to security events within cloud environments (e.g., Azure, AWS, Google Cloud).
  • Investigate cloud‑native logs: Azure Activity Logs, AWS CloudTrail, GCP Audit Logs, identity events, network flows, and storage access.
  • Evaluate cloud security posture, identifying misconfigurations, risky access patterns, and drift.
  • Assist in development of cloud detection logic using native tooling (e.g., Azure Sentinel, Microsoft Defender XDR, AWS GuardDuty, GCP SCC).
• Security Tooling & Automation
  • Maintain and enhance SOC tooling, dashboards, and automation workflows (SOAR).
  • Build automated playbooks to speed up triage, enrichment, and response.
  • Integrate new data sources and improve log ingestion pipelines for SIEM/EDR.
• Threat Intelligence & Research
  • Utilize internal and external threat intelligence to contextualize alerts and strengthen detections.
  • Track adversary TTPs based on frameworks such as MITRE ATT&CK.
  • Research emerging threats, vulnerabilities, and malware families.
• Collaboration, Compliance & Reporting
  • Partner with governance, engineering, and IT teams to ensure effective remediation and long‑term control improvements.
  • Support audit, compliance, and regulatory requirements related to incident management.
  • Prepare clear, concise technical and executive‑level reports.

Key Competencies

• Analytical mindset with strong problem‑solving skills.
• Ability to work under pressure during active incidents.
• Excellent written and verbal communication skills.
• Strong attention to detail and a commitment to continuous improvement.

Qualifications

The SOC/Incident Response Engineer should have 3–7 years of experience in a Security Operations Center (SOC), incident response, digital forensics, or a closely related cybersecurity discipline. A strong technical foundation in networking, operating system internals across Windows, Linux, and macOS, identity systems, and modern cloud architectures is essential. The role requires hands‑on experience with leading security technologies, including SIEM platforms such as Microsoft Sentinel or Splunk, endpoint detection and response (EDR) and antivirus tools like Microsoft Defender for Endpoint or CrowdStrike, and forensic toolsets including Velociraptor, Autopsy, FTK, and KAPE. Experience utilizing malware analysis sandboxes and static analysis frameworks, as well as cloud security tools such as Azure Defender, AWS GuardDuty, and Google Cloud Security Command Center (SCC), is also required. Familiarity with scripting and automation languages, particularly Python, PowerShell, and KQL, is highly desirable. Preferred certifications include GIAC GCIA, GCFA, GCIH, or GNFA; AWS Security Specialty or Google Professional Cloud Security Engineer; and industry‑recognized credentials such as CISSP, CEH, or CySA+ (or their equivalents).

Salary

The salary range for this position is $112K to $139K.

EEO Statement

Benesch is an equal opportunity employer. We strongly value and encourage diversity and solicit applications from all qualified applicants without regard to race, color, gender, sex, age, religion, creed, national origin, ancestry, citizenship, marital status, sexual orientation, physical or mental disability (where applicant is qualified to perform the essential functions of the job with or without reasonable accommodations), medical condition, protected veteran status, gender identity, genetic information, or any other characteristic protected by federal, state, or local law.

Disability Accommodation

Applicants who are interested in applying for a position and require special assistance or an accommodation during the process due to a disability should contact the Benesch Human Resources Department by phone at 216‑363‑4578 or email Christopher Watson at [e-mail].