Job Description
Fragomen, an AmLaw 100 Firm and the leading global immigration services provider, is seeking a Cyber Security Engineer with strong experience in Incident Response, digital forensics, and threat detection to join our Information Security & Cyber Security team.
Our industry-leading, immigration-specific technology and infrastructure is undergoing significant transformation, and security is critical to its success. We are seeking a professional who is passionate about protecting the organization, capable of leading response efforts during security incidents, and eager to mature enterprise-wide incident detection, investigation, and response capabilities.
You will join a team of security engineers who make security a differentiator in our technology offerings. The successful candidate will play a key role in detecting, investigating, containing, and remediating cyber incidents, while helping to strengthen Fragomen’s overall security posture.
How Will You Make a Difference at Fragomen?
As a Security Engineer focused on Incident Response, you will:
- Lead and support end-to-end incident response activities, including detection, analysis, containment, eradication, and recovery.
- Monitor, investigate, and correlate security alerts using SIEM, EDR, and forensic tools.
- Perform digital forensic investigations across endpoints, servers, cloud, and network environments.
- Triage and escalate security events in accordance with established incident response procedures.
- Develop, maintain, and continuously improve incident response playbooks, SOPs, and workflows.
- Improve alert quality and response effectiveness through root cause analysis and post-incident reviews.
- Partner with IT, Legal, Compliance, Privacy, and Risk teams during security incidents.
- Support regulatory, legal, and client-driven incident response and reporting requirements.
- Participate in and facilitate incident response tabletop exercises and simulations.
- Contribute to the design and enhancement of detection, logging, and monitoring capabilities.
- Provide technical guidance and mentorship to junior analysts and security team members.
Required Qualifications
- 1+ years of experience in cybersecurity, incident response, or security operations.
- Hands-on experience responding to security incidents in enterprise environments.
- Strong ability to analyze security events and perform technical investigations.
- Working knowledge of:
- TCP/IP, DNS, HTTP/S, VPNs, firewalls, and proxy technologies
- Windows and Linux operating systems
- Identity and access systems and authentication mechanisms
- Experience using SIEM and security platforms such as:
- Splunk, Microsoft Sentinel, QRadar, ArcSight, ELK, or similar
- Ability to identify and respond to:
- Phishing and business email compromise
- Malware and ransomware
- Credential compromise
- Lateral movement and persistence mechanisms
- Brute-force and privilege escalation attacks
- Strong written and verbal communication skills, especially during high-pressure incidents.
- Demonstrated ability to follow structured processes while continuously improving them.
Preferred Qualifications
- Experience with EDR, SOAR, and forensic tooling (e.g., CrowdStrike, Defender, Carbon Black, EnCase, Velociraptor, etc.).
- Experience supporting investigations involving legal, compliance, or regulatory stakeholders.
- Knowledge of MITRE ATT&CK and modern adversary tactics.
- Experience with cloud and SaaS incident response (Azure, M365, AWS, etc.).
- Relevant certifications, including:
- GIAC (GCIH, GCFA, GCIA)
- Offensive Security (OSCP, OSCE, OSEE)
- Vendor certifications (Splunk, Sentinel, CrowdStrike, etc.)
All offers and/or employment contracts are contingent upon the successful completion of the Firm’s pre-employment screening process. This process may include verifying the candidate’s identity, confirming legal authorization to work in the offered position's location, and conducting a comprehensive background check, where permitted by local regulations.
