SOC/Incident Response Engineer

beneschlaw; Columbus (OH); Hybrid; USD 100,000 - 150,000; Full time

Job summary

Benesch is seeking a SOC/Incident Response Engineer to detect and resolve cybersecurity threats, combining threat detection, forensics, malware triage, and cloud security in a 24/7 SOC.

The role covers security monitoring, incident response lifecycle, cloud security, and automation to strengthen the security posture across hybrid environments.

Qualifications

• 3–7 years in a SOC, IR, or digital forensics field.
• Strong foundation in Windows, Linux, macOS, networking, and cloud architectures.
• Experience with Microsoft Sentinel or Splunk and EDR tooling.

Responsibilities

• Monitor SIEM/EDR/NDR and cloud-native security tools to detect incidents.
• Tune detection rules, correlation logic, and analytics use cases.
• Lead incident lifecycle: investigation, containment, recovery, and analysis.
• Coordinate IR with IT, cloud, and business teams; document findings.
• Perform digital forensics on endpoints, servers, and cloud resources.

Skills

Analytical mindset

Work under pressure

Communication skills

Attention to detail

Problem-solving

Continuous improvement

Education

GIAC GCIA

GIAC GCFA

GCIH

GNFA

CISSP

CEH

CySA+

AWS Security Specialty

Google Professional Cloud Security Engineer

Tools

Microsoft Sentinel

Splunk

Microsoft Defender for Endpoint

CrowdStrike

Velociraptor

Autopsy

FTK

KAPE

KQL

Python

PowerShell

Azure Defender

AWS GuardDuty

Google Cloud SCC

Job description

About the Firm

At Benesch we pride ourselves on exceeding expectations and building trust with our clients and employees. We are consistently recognized on top workplace lists in Chicago and Cleveland, and we rank among the top 125 law firms nationally. The firm offers a hybrid schedule, career development, transparent leadership, and celebrates diversity, equity, and inclusion. Full benefit information is available on the company website.

Position Summary

We are looking for a SOC/Incident Response Engineer to help detect and resolve cybersecurity threats. This role combines threat detection, digital forensics, malware triage, and cloud security expertise to protect organizational assets, reduce risk, and strengthen security posture within a 24/7 security operations environment.

Position Responsibilities

Security Monitoring & Threat Detection

• Monitors SIEM, EDR, NDR, and cloud-native security tools to identify suspicious activity and potential security incidents.
• Creates, tunes, and optimizes detection rules, correlation logic, and analytic use cases.
• Conducts threat hunting based on emerging TTPs, threat intel, and anomaly patterns.
• Maintains and improves alerting fidelity to reduce false positives and enhance detection precision.

Incident Response & Triage

• Performs initial triage of security alerts to assess severity, impact, and required response actions.
• Leads full incident lifecycle activities including investigation, containment, eradication, recovery, and post‑incident analysis.
• Coordinates with IT, cloud, and business teams to execute IR playbooks and minimize operational impact.
• Documents incidents, findings, and lessons learned; contributes to after‑action reviews.

Digital Forensics & Malware Analysis

• Conducts forensic acquisition and analysis of endpoints, servers, cloud resources, and network artifacts (disk, memory, logs).
• Examines artifacts such as registry hives, event logs, file systems, network captures, browser history, and persistence mechanisms.
• Performs malware triage (dynamic and static) to determine malware behavior, indicators of compromise, and propagation mechanisms.
• Maintains chain‑of‑custody processes and ensures forensic data integrity for potential legal or compliance requirements.

Cloud Security & IR

• Monitors and responds to security events within cloud environments (Azure, AWS, Google Cloud).
• Investigates cloud‑native logs: Azure Activity Logs, AWS CloudTrail, GCP Audit Logs, identity events, network flows, and storage access.
• Evaluates cloud security posture, identifying misconfigurations, risky access patterns, and drift.
• Assists in development of cloud detection logic using native tooling (Azure Sentinel, Microsoft Defender XDR, AWS GuardDuty, GCP SCC).

Security Tooling & Automation

• Maintains and enhances SOC tooling, dashboards, and automation workflows (SOAR).
• Builds automated playbooks to speed up triage, enrichment, and response.
• Integrates new data sources and improves log ingestion pipelines for SIEM/EDR.

Threat Intelligence & Research

• Utilizes internal and external threat intelligence to contextualize alerts and strengthen detections.
• Tracks adversary TTPs based on frameworks such as MITRE ATT&CK.
• Researches emerging threats, vulnerabilities, and malware families.

Collaboration, Compliance & Reporting

• Partners with governance, engineering, and IT teams to ensure effective remediation and long‑term control improvements.
• Supports audit, compliance, and regulatory requirements related to incident management.
• Prepares clear, concise technical and executive‑level reports.

Key Competencies

• Analytical mindset with strong problem‑solving skills.
• Ability to work under pressure during active incidents.
• Excellent written and verbal communication skills.
• Strong attention to detail and a commitment to continuous improvement.

Qualifications

The SOC/Incident Response Engineer should have 3–7 years of experience in a Security Operations Center (SOC), incident response, digital forensics, or a closely related cybersecurity discipline. A strong technical foundation in networking, operating system internals across Windows, Linux, and macOS, identity systems, and modern cloud architectures is essential. Experience with leading security technologies such as Microsoft Sentinel or Splunk, endpoint detection and response tools like Microsoft Defender for Endpoint or CrowdStrike, and forensic toolsets (Velociraptor, Autopsy, FTK, KAPE) is required. Familiarity with malware analysis sandboxes, scripting and automation languages (Python, PowerShell, KQL), and cloud security tools (Azure Defender, AWS GuardDuty, Google Cloud SCC) is highly desirable. Preferred certifications include GIAC GCIA, GCFA, GCIH, GNFA; AWS Security Specialty or Google Professional Cloud Security Engineer; and industry‑recognized credentials such as CISSP, CEH, or CySA+ (or equivalents).

Equal Opportunity Employment

Benesch is an equal opportunity employer. We encourage applications from all qualified candidates regardless of race, color, gender, religion, national origin, disability, veteran status, sexual orientation, age, or any other characteristic protected by law. Applicants requiring accommodations during the application process can contact Benesch Human Resources at 216‑363‑4578 or email Christine Watson at [e-mail].