Senior Cyber Incident Response Engineer

1. About Our Client:
The organization operates in the media and entertainment industry, creating and distributing content across film, television, and streaming platforms. It also manages global theme park destinations, consumer products, and experiences. The company owns and operates notable entertainment and news brands and produces filmed entertainment through various studios. It addresses the challenge of delivering diverse and engaging content to a wide audience while maintaining operational scale and impact.
2. About the Opportunity:
The Senior Cyber Incident Response Engineer role focuses on enhancing the technical systems and workflows involved in detecting, investigating, containing, and recovering from cybersecurity incidents. This position plays a critical role in developing automation and tools that enable rapid and effective incident response, improving operational readiness, and reducing response times.
3. Responsibilities:
Design and improve automated evidence collection for faster and more thorough investigations.
Develop and maintain SOAR playbooks to manage investigation and containment workflows.
Integrate various security platforms to unify response actions and enhance analyst context.
Create response tools, potentially leveraging AI, across multiple environments including cloud and endpoint.
Develop scripts and integrations supporting triage, containment, and forensic workflows.
Ensure availability of logs, telemetry, access, and tools for timely response.
Build dashboards and metrics to monitor response effectiveness.
Automate repetitive manual analyst tasks to improve efficiency.
Review and enhance incident response plans and readiness strategies.
Align playbooks to threats and business needs for quick incident identification.
Collaborate with operations and automation teams on prioritization and integration.
Support or lead drills and readiness activities.
Lead or assist complex investigations to determine incident scope and root cause.
Partner with teams on containment, remediation, recovery, and post-incident actions.
Present findings and recommendations to technical teams and leadership.
Contribute to standards, documentation, and knowledge sharing.
Participate in an on-call incident response rotation.
4. Requirements:
Minimum 5 years in cybersecurity roles such as incident response, DFIR, detection engineering, threat hunting, or SOC escalation.
At least 2 years in security automation or cyber defense engineering.
Proficiency in scripting languages like Python, PowerShell, or Bash.
Ability to lead projects independently with strong communication skills.
Knowledge of SIEM, SOAR, EDR, Data Lake, and enterprise security tools.
Experience investigating diverse cyber threats across enterprise platforms.
Experience building and maintaining API integrations.
Familiarity with SIEM query languages such as SPL, KQL, or SQL.
Expertise with EDR response actions and endpoint containment.
Experience designing or operating SOAR platforms and automated playbooks.
Understanding of telemetry and evidence collection across endpoints, identity, network, cloud, email, and SaaS.
Capability to design scalable and repeatable automation solutions.
5. Pay Range and Compensation Package:
The pay range and compensation package for this role will be determined based on the candidate’s experience, skills, and other relevant factors.
Equal Opportunity Statement:
Equal Opportunity Statement: Our client is an equal opportunity employer. They celebrate diversity and are committed to creating an inclusive environment for all employees. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, or national origin.
Note:
RemoteHunter is a recruitment partner of this role. Please note that all employment decisions, including candidate assessment, interviews, hiring, compensation, and employment terms, are made exclusively by the hiring employer.

Work arrangement
Yes