> Markdown version of [/jobs/ext/4302766-senior-security-threat-engineer](https://www.wearedevelopers.com/jobs/ext/4302766-senior-security-threat-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Security Threat Engineer

- **Company:** HCA Healthcare Inc.
- **Location:** Nashville, TN, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, Cyber Security, Linux, Digital Forensics, Identity and Access Management, Performance Tuning, Security Information and Event Management, Cyber Threat Analysis, Azure Security Center, Splunk
- **Published:** October 17, 2026
- **Apply:** https://dejobs.org/x/x/08FD26E6047148ECBE99701CE8F14802/job/

## About the Role

* Five or more years of relevant experience in any of the following domains: cyber incident response, digital forensics, threat response, insider threat, security operations.
 * Experience with Endpoint Detection and Response (EDR) platforms such as Microsoft Defender for Endpoint or comparable tools.
 * Experience performing security analysis with Security Information and Event Management (SIEM) technologies; Splunk and SPL experience are preferred.
 * Experience deploying, tuning, or operating security tools and working directly with vendors to improve investigative capabilities.

RELEVANT WORK EXPERIENCE

 * 5+ years

EDUCATION

 * Bachelor's Degree Preferred

OTHER/SPECIAL QUALIFICATIONS

The successful candidate will possess the following aptitudes and skillsets:

 * Sound investigative judgment and the discipline to separate established facts, reasonable inference, and unresolved questions.
 * Ability to lead incident response and investigative work calmly and professionally under time pressure.
 * Strong written and verbal communication skills, including the ability to explain technical findings and risk to non-technical stakeholders.
 * Ability to maintain confidentiality, handle sensitive data appropriately, and follow ethical practices when using investigative tools and accessing data.
 * Ability to prioritize work based on business impact, criticality, and threat level while maintaining clear case documentation.
 * Ability to mentor teammates, share technical knowledge, and contribute to the development of team capabilities.

Helpful certifications and courses (not required):

 * GIAC GCIH, GCFA, GNFA, GCIA, GMON, CISSP, or comparable credentials.

## Description

The Senior Threat Response Engineer is an individual contributor responsible for investigating and responding to security events. The engineer leads complex investigations from initial triage through scoping, evidence collection, containment, remediation, documentation, and stakeholder communication. The role requires strong judgment when information is incomplete and the ability to develop clear, supportable conclusions from endpoint, identity, network, web, email, cloud, and other security telemetry.

This role also serves as a technical owner and subject matter expert for forensic tooling and endpoint agents. The engineer will help operate and improve tooling, support deployments and vendor coordination, develop investigative workflows, and transfer knowledge across the team. Successful candidates can take an ambiguous problem, determine what evidence is needed, and drive the work to a defensible conclusion., * Triage security detections and reports, distinguish expected activity from credible threats, and provide clear containment and remediation recommendations.

 * Perform Windows artifact and forensic analysis, including program execution, file and account activity, persistence, memory, and other endpoint evidence; familiarity with Linux and macOS investigation is helpful.
 * Perform digital forensics and incident response across endpoint, identity, network, web, email, and cloud telemetry; build timelines, correlate evidence, determine root cause, and document supportable conclusions.
 * Maintain appropriate evidence handling, case documentation, confidentiality, and ethical use of security tools and sensitive data.
 * Communicate findings, uncertainty, risk, and recommendations to technical and non-technical stakeholders, including leadership, Legal, Risk/Governance, Human Resources, Ethics & Compliance, and other partners as appropriate.
 * Partner with Security Engineering, Identity and Access Management, Networking, Endpoint, Vulnerability/Patching, Threat Intelligence, and other teams to investigate and remediate threats.
 * Improve detection and investigation procedures through threat hunting, runbook development, post-incident lessons learned, and feedback to security tooling and engineering teams.
 * Mentor and onboard analysts, lead knowledge-sharing sessions, and support technical evaluation and interviewing as requested.