Staff Incident Response Engineer

Description

This is a staff-level incident response role on the security organization's team, which builds security solutions that protect the company and its customers.

The team helps customers move their most sensitive data and workloads to the cloud, and the company aims to be the most trusted SaaS provider.

The team provides 24x7 operational support.

Responsibilities

• Watch the tools and systems that defend production and regulated environments, and connect events that look unrelated.
• Lead the response to incidents that affect customers, and follow each incident through to closure across functional teams.
• Handle threats and attacks aimed at individual customer accounts and environments.
• Write post-incident reports, forensic reports, and remediation plans.
• Support audits, compliance work, and regulatory investigations.
• Create and maintain incident response playbooks, handbooks, and cybersecurity standards.
• Set and maintain secure configuration baselines for devices you control directly, such as security tools, and for devices you do not, such as workstations, servers, and network devices. Use that data to analyze vulnerabilities.
• Act as an escalation point and take part in the on-call rotation, including after-hours and weekend shifts outside standard business hours.
• Help deploy, integrate, and initially configure new security solutions and upgrades to existing ones, across networks and systems, to strengthen overall security posture.

Requirements

• Experience using AI in work processes, decision-making, or problem-solving, or critically assessing how to apply it. This can include AI-powered tools, workflow automation, analyzing AI-driven insights, or judging AI's likely effect on the function or industry.
• 6+ years of related experience, or an equivalent mix of education and experience.
• 7 to 10+ years of related experience, or an equivalent mix of education and experience.
• Automation skills in Python and bash scripting, and experience hardening Linux, Windows, or Mac systems.
• Experience with data logging applications such as Splunk.
• Knowledge of vulnerability scanning tools such as Qualys and Nessus.
• A defensive security mindset.
• The ability to explain complex issues to executives and customers.
• Thorough understanding of Security Operations Center operations and security incident response protocols and procedures.
• Extensive experience in incident response, digital forensics, threat hunting, and threat intelligence.
• A solid networking foundation, including TCP/IP and core protocols.
• Experience with SIEM platforms such as Splunk, plus EDR and SOAR tools.
• The ability to analyze event and system logs, run host and memory forensics including live response on Windows, macOS, and/or Linux, and examine malware.
• Experience writing internal playbooks, handbooks, and incident response frameworks.
• Knowledge of attack vectors, threat tactics, and attacker techniques.
• Knowledge of cloud security concepts and experience with AWS, Azure, or GCP.
• Coding or scripting experience in one or more general-purpose languages.
• Working knowledge of Canadian regulatory requirements for financial services and public sector clients.
• Excellent written and verbal communication, including explaining incidents to executives and customers.
• Willingness to work weekend and after-hours shifts to respond to priority incidents promptly.
• GCIH, GCFA, GCIA, GMON, GSEC, CISSP, or CEH certifications (a plus).
• The company platform knowledge (a plus).
• GSEC, GCIH, CEH, GCIA, or CISSP certifications (a plus).
• Experience in Canadian regulated markets such as financial services or the public sector (highly desirable).

Conditions

This role requires successful completion of a Government of Canada Reliability Status screening as a condition of employment, covering 5 years of verifiable background history.

The screening includes identity verification, education verification, a criminal record check, and a credit check.

You must be able to obtain and keep Reliability Status, which generally requires Canadian citizenship or Canadian permanent resident status.

The role may require security clearance in the future.

Employment depends on successfully completing and maintaining the required screening.

The role may involve a rotating schedule with non-standard hours, weekends, and statutory holidays.

Work persona is flexible, remote, or required in office, based on the nature of the work and your assigned work location.

The company may use a third-party service to check the distance between your primary residence and the nearest company office to determine work persona eligibility.

Benefits

• Base pay of $109,400 - $191,500 for positions in this location, plus equity when applicable, variable or incentive compensation, and benefits.
• The base pay shown is a guideline, and total compensation varies based on qualifications, skill level, competencies, and work location.
• Compensation depends on the geographic location of the role and may change based on work location.
• Health plans, including flexible spending accounts.
• Employee stock purchase plan (ESPP).
• Matching donations.
• A flexible time away plan and family leave programs.
• Sales positions generally offer an On Target Earnings (OTE) incentive structure.