Threat & Incident Response Engineer (OT & Hunting)

Volanno; Seattle (WA); On-site; USD 150,000 - 185,000; Full time

Job summary

Volanno is seeking two Threat and Incident Response Engineers to support Sound Transit. You will handle security incidents across corporate IT and OT environments, triaging alerts from SIEM/EDR/NDR, and coordinating containment, eradication, and recovery. You will also perform proactive threat hunting with OT-visible telemetry.

The role emphasizes detection tuning, SOAR automation, and writing incident reports and playbooks. Occasional onsite work around Seattle is expected as needed.

Qualifications

• Bachelor's degree in Computer Science, Information Security, Information Systems, or related field.
• Minimum ten (10) years of cybersecurity operations for senior or five (5) years for mid-level positions.
• Experience responding to incidents in OT/IC/SCADA environments, not enterprise IT alone.
• Ability to pass a Sound Transit background check.
• Ability to work Pacific Time business hours and onsite in the Seattle area on occasion.

Responsibilities

• Own end-to-end security incidents from triage to containment, eradication, and recovery; produce post-incident reviews.
• Develop and tune detection content in SIEM/EDR and coordinate with OT/plant teams as needed.
• Lead threat hunting activities and map coverage to MITRE ATT&CK.
• Create incident playbooks, root-cause analyses, and metrics such as MTTD/MTTR.
• Collaborate across information security, infrastructure, operations, and engineering teams.

Skills

Incident response management

Threat hunting

MITRE ATT&CK

Written communication

Cross-functional collaboration

Education

Bachelor's degree in Computer Science, Information Security, Information Systems

Tools

Microsoft Sentinel

Splunk

QRadar

Microsoft Defender for Endpoint

CrowdStrike

SentinelOne

Dragos

Claroty

Nozomi Networks

Job description

Volanno is seeking two Threat and Incident Response Engineers to support Sound Transit. You will handle security incidents across corporate IT and OT environments, triaging alerts from SIEM/EDR/NDR, and coordinating containment, eradication, and recovery. You will also perform proactive threat hunting with OT-visible telemetry.

The role emphasizes detection tuning, SOAR automation, and writing incident reports and playbooks. Occasional onsite work around Seattle is expected as needed.