> Markdown version of [/jobs/ext/2067517-security-incident-response-engineer](https://www.wearedevelopers.com/jobs/ext/2067517-security-incident-response-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Incident Response Engineer - **Company:** Acrisure LLC - **Location:** Valhalla, NY, United States - **Experience:** Experienced - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Active Directory, Apple Mac Systems, Cloud Computing, Cloud Computing Security, Cyber Security, Query Languages, Linux, Digital Forensics, Identity and Access Management, Intrusion Detection and Prevention, Python (Programming Language), Log Analysis, Network Architecture, Performance Tuning, Windows PowerShell, Kusto Query Language, Security Information and Event Management, Software Vulnerability Management, Windows Desktop, Scripting, Cloud Platform System, Mitre Att&ck, Mttr, QRadar, Cyber Threat Analysis, Azure Security Center, Falcon Platform, Information Technology, Cybercrime, Microsoft Sentinel, Purple Team (Cyber Security), Splunk, SentinelOne Expertise - **Published:** August 15, 2026 - **Apply:** https://www.dice.com/job-detail/a9dcbfc4-d827-4fe5-81bf-48cb1583671b ## About the Role * Bachelor's degree in Computer Science, Information Security, Cybersecurity, or related discipline (or equivalent experience). * Minimum 3 years of progressive information security experience. * Strong understanding of incident response methodologies, attack lifecycle, and containment strategies. * Experience with one or more EDR platforms such as Microsoft Defender for Endpoint, SentinelOne, CrowdStrike, or equivalent. * Experience with SIEM technologies such as Microsoft Sentinel, Google SecOps, Splunk, QRadar, or similar platforms. * Knowledge of Microsoft 365, Entra ID, Active Directory, and cloud security concepts. * Understanding of MITRE ATT&CK, threat intelligence, and threat hunting methodologies. * Familiarity with Windows, Linux, and macOS operating systems. * Ability to analyze logs, indicators of compromise (IOCs), and attacker techniques. * Experience with PowerShell, Python, KQL, or other scripting/query languages., Candidates should be comfortable with an on-site presence to support collaboration, team leadership, and cross-functional partnership. ## Description The Security Incident Response Engineer is responsible for detecting, investigating, containing, eradicating, and recovering from cybersecurity incidents across Acrisure's global environment. This role serves as a key member of the Security Operations team and works closely with Infrastructure, Cloud, Identity, Workplace Technology, Legal, Privacy, Human Resources, and business stakeholders to rapidly respond to security threats and reduce organizational risk. The engineer leverages enterprise security technologies including EDR, SIEM, cloud security platforms, email security solutions, threat intelligence, and security automation tooling to identify and respond to attacks impacting endpoints, identities, cloud environments, applications, and data. This position combines hands-on incident response, threat hunting, detection tuning, forensic investigation, and continuous improvement activities. Success in this role means rapidly detecting and containing threats before they become business-impacting events, continuously improving the organization's ability to respond to attacks, and driving measurable reductions in response times, incident severity, and operational risk. Responsibilities: Incident Response Operations * Investigate and respond to cybersecurity incidents involving endpoints, identities, cloud platforms, email systems, applications, data, and network infrastructure. * Perform incident triage, severity classification, impact analysis, containment, eradication, and recovery activities. * Execute cyber incident response procedures and escalation processes in accordance with the Cyber Incident Response Plan (CIRP). * Coordinate response efforts across Security, Infrastructure, Cloud, IAM, Workplace Technology, Legal, Privacy, Human Resources, and business teams. * Support major incident management activities and provide technical leadership during active security events. * Maintain detailed incident records, timelines, evidence, findings, and lessons learned. Threat Detection and Investigation * Analyze alerts generated by EDR, SIEM, MDR, email security, cloud security, deception, and threat intelligence platforms. * Validate suspicious activity to distinguish true security incidents from false positives. * Perform root cause analysis to identify attack vectors, affected assets, compromised accounts, and attacker activities. * Conduct proactive threat hunting to identify indicators of compromise, adversary behaviors, and emerging threats. * Leverage MITRE ATT&CK techniques to improve detection and investigative effectiveness. Digital Forensics and Evidence Collection * Collect, preserve, and analyze system, endpoint, cloud, email, and identity-related evidence. * Perform log analysis, forensic triage, malware investigation, and timeline reconstruction. * Support legal, regulatory, audit, and compliance investigations as required. * Maintain evidence handling and chain-of-custody procedures where applicable. Security Engineering and Continuous Improvement * Develop and maintain incident response playbooks, investigation procedures, and operational runbooks. * Recommend detection improvements, new use cases, automations, and response capabilities. * Tune security alerts and detection logic to improve fidelity and reduce false positives. * Assist in the implementation and improvement of SOAR workflows and automated response capabilities. * Participate in tabletop exercises, incident simulations, and purple team activities. Metrics and Reporting * Track and report operational metrics including: * Mean Time to Detect (MTTD) * Mean Time to Respond (MTTR) * Incident volume * Severity trends * Containment effectiveness * Detection fidelity * Produce incident reports, executive summaries, and post-incident reviews. * Identify recurring trends and recommend corrective actions. Collaboration and Enablement * Partner with Security Engineering teams to improve telemetry, monitoring, and investigative capabilities. * Work with Vulnerability Management and Exposure Management teams on remediation activities resulting from incidents. * Provide guidance and mentorship to analysts and junior responders. * Participate in after-hours incident response and on-call rotations as required. ## Related Videos - [What Developers Get Wrong About Application Quality](https://www.wearedevelopers.com/videos/233-what-developers-get-wrong-about-application-quality) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker) - [Discover the open source trio you didn’t expect: .NET and PostgreSQL on Linux](https://www.wearedevelopers.com/videos/2042-discover-the-open-source-trio-you-didn-t-expect-net-and-postgresql-on-linux) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)