SOC Security Engineer II: Threat Hunter & Incident Response

CSX Corporation; Jacksonville (FL); On-site; USD 110,000 - 150,000; Full time

Job summary

CSX Corporation is seeking a Security Engineer II for its Security Operations Center in the Jacksonville area. You will monitor, detect, analyze, investigate, and respond to cybersecurity threats impacting CSX systems, networks, and data across rail operations and corporate assets.

Responsibilities include leading incident response efforts, developing detection use cases, and collaborating with infrastructure, engineering, and business teams to strengthen CSX’s cyber posture.

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related field.
• 3+ years of cybersecurity experience.
• 2 years in a Security Operations Center, incident response, security engineering, or a related security role.
• Experience investigating security incidents across enterprise environments.
• Experience with Microsoft security technologies and cloud security solutions.
• Equivalent minimum qualifications include HS Diploma and 8+ years in cybersecurity.

Responsibilities

• Monitor security alerts and events across SIEM, EDR, email, cloud, and network security platforms.
• Investigate and respond to cybersecurity incidents including malware, phishing, ransomware, and data loss.
• Analyze endpoint, network, cloud, identity, and application security events.
• Perform incident triage, containment, eradication, recovery, and post-incident documentation.
• Participate in major incident response activities and cyber crisis management.

Skills

Security operations

Incident response

Threat hunting

Threat intelligence analysis

Scripting (PowerShell, Python)

Education

Bachelor's degree in Cybersecurity/CS/IT/Engineering

High School Diploma/GED

Tools

Microsoft Defender XDR

Microsoft Sentinel

Microsoft Defender for Endpoint

Microsoft Entra ID

Job description

CSX Corporation is seeking a Security Engineer II for its Security Operations Center in the Jacksonville area. You will monitor, detect, analyze, investigate, and respond to cybersecurity threats impacting CSX systems, networks, and data across rail operations and corporate assets.

Responsibilities include leading incident response efforts, developing detection use cases, and collaborating with infrastructure, engineering, and business teams to strengthen CSX’s cyber posture.