Cyber Security Engineer - Remote U.S.

***CYBER SECURITY ENGINEER***

Remote Role

U.S./Canada - Eastern Time Zone

Overview

The primary purpose of this role is to investigate escalated alerts from the SOC to determine true positives and mitigate infections. Additional responsibilities of this role include proactively securing Altera systems to prevent intrusion and notify the appropriate stakeholders if an event occurs. 

We are seeking a Mid-Tier Incident Response Analyst to join our Incident Response Team. In this role, you'll act as a key responder in the incident lifecycle, handling escalated alerts, conducting in-depth investigations, and supporting containment and recovery efforts. This is a hands-on technical position requiring a solid understanding of security operations, threat detection, and incident handling procedures. The ideal candidate is a highly motivated and inquisitive individual who thrives in a collaborative, fast-paced setting and is eager to expand their skillset. 

Responsibilities

• Monitor, investigate, and respond to security alerts escalated from SOC analysts. 

• Perform in-depth analysis of logs and endpoint data to identify indicators of compromise (IOCs) and determine root cause. 

• Participate in incident containment, mitigation, and remediation efforts. 

• Coordinate with cross-functional teams (IT, Legal, Risk) during security incidents. 

• Support threat hunting initiatives and continuous tuning of detection tools (SIEM(s), EDR, IDS). 

• Document incident response activities and produce post-incident reports. 

• Mentor SOC analysts and contribute to playbook and process development. 

• Engage in continuous learning and cross-training to develop expertise in both security engineering and incident response. 

• Contribute to the evaluation and implementation of new security tools and technologies. 

• Collaborate with other teams to ensure security best practice and defined policies are integrated into all aspects of the business. 

Qualifications

Academic and Professional Qualifications:

• Bachelor’s degree or equivalent/years of experience required.
• Advanced certifications such as CISSP, CISA, or CESSLP, MS-500, AZ-500 strongly preferred

Experience:

• 2–4 years of experience in a security operations or incident response role. 

• Proficiency with SIEM tools (e.g., Splunk, QRadar, Sentinel) and endpoint detection tools (e.g., CrowdStrike, SentinelOne). 

• Strong understanding of TCP/IP, operating systems (Windows/Linux), malware behaviors, and common attack vectors (e.g., phishing, ransomware, lateral movement). 

• Experience analyzing logs from various sources: firewalls, proxies, IDS/IPS, and authentication systems. (e.g., KQL, CQL, RegEx) 

• Ability to work under pressure and manage multiple incidents simultaneously. 

• Excellent verbal and written communication skills. 

Travel Requirements:

• Minimal travel is expected, primarily for conferences and internal meetings.

Working Arrangements:

• This is a fully remote position based in the U.S. or Canada. The team primarily operates within the Eastern Time Zone, and work hours should align accordingly. 

• Participation in an after-hours On-Call rotation will be expected after an initial period of onboarding and training (On-Call is approximately every six weeks for one week).