Principal Incident Response Security Engineer

🔥 0 minutes ago

🇺🇸 United States – Remote

💵 $138k - $200.1k / year

⏰ Full Time

🔴 Lead

🛡️ Security Operations

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 0%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Empower

WebsiteLinkedInAll Job Openings

10,000+ employees

💸 Finance

💳 Fintech

👥 B2C

Finance • Fintech • B2C

Empower is a leading provider of financial services focused on helping individuals and organizations achieve financial freedom through retirement planning and investment management. Serving over 19 million Americans, Empower offers a comprehensive suite of finance-related services, including smart planning and investment advice, and tools like the Empower Personal Dashboard™ for a complete financial view. The company is renowned as a top retirement plan provider and works closely with personal investors, workplace plan savers, plan sponsors, and financial professionals. Empower is also recognized for initiatives in Diversity, Equity, Inclusion, and has a social commitment that bolsters community impact.

📋 Description

• Lead major cybersecurity incidents from detection through containment, eradication, recovery, and post-incident review • Participate in the on-call rotation • Serve as the top escalation point for complex, high-severity incidents • Develop, maintain, and optimize incident response playbooks, runbooks, and escalation procedures • Oversee enterprise-wide monitoring of networks, cloud, and endpoints for threats, vulnerabilities, and anomalous activity • Advance detection capabilities using EDR, SIEM, and behavioral analytics aligned with MITRE ATT&CK • Act as subject matter expert on EDR and SIEM • Design and implement automation frameworks using Python, PowerShell, and AWS Lambda • Integrate AI/ML models into security monitoring and response processes • Conduct forensic investigations and threat hunting • Identify root causes and emerging threat patterns • Collaborate with infrastructure, application, and network teams on secure configurations and compliance • Mentor and guide incident response analysts • Communicate with executives and technical teams during and after incidents • Produce clear incident reports and recommendations • Drive continuous improvement in detection, response, and prevention strategies • Contribute to and strengthen the corporate Information Security program • Develop, update, document, and maintain organizational security standards and policies • Help establish and communicate secure computing practices • Support compliance with established guidelines and regulatory requirements • Contribute to security due diligence assessments of current and prospective vendors and products

🎯 Requirements

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field • Must have current and active CISSP Certification • 6+ years of experience in enterprise cybersecurity at scale • 5+ years of experience with EDR, SIEM, email and network security • 3+ years of experience with cloud environment security and scripting/coding • Extensive knowledge of the incident response process and lifecycle • Ability to contribute to security policy and procedures • Ability to respond to security alerts/incidents and drive the process start to finish • Ability to use generative AI in day-to-day operations • Strong technical written and verbal communication skills • Strong analytic skills for root cause analysis, resolution, lessons learned, and improvements • Excellent communication and leadership skills • Additional certifications such as SANS, GIAC, CCSP, AWS, CEH, or OSCP are advantageous • Experience in a DevSecOps environment, including infrastructure as code, Terraform, and Git, is advantageous • Experience developing automation frameworks with Python, PowerShell, Bash, and serverless technologies such as AWS Lambda • Experience automating enrichment, correlation, and containment tasks • Ability to integrate AI and machine learning models into security monitoring and response workflows • Ability to create AI-driven anomaly detection, behavioral analysis, natural language processing, log analysis, phishing detection, and threat intelligence enrichment • Strong Linux, Windows, network, and database skills • Experience with technical leadership • Experience as a security specialist in a regulated IT environment, including some combination of SOX, HIPAA, GLBA, and PCI • Applicants must be authorized to work for any employer in the U.S.; employment visa sponsorship is unavailable, including CPT/OPT • Reliable high-speed internet with a wired connection and a suitable home workspace required for remote work

🏖️ Benefits

• Medical, dental, vision and life insurance • 401(k) plan with generous company matching contributions up to 6% • Financial advisory services • Potential company discretionary retirement contribution • Broad investment lineup • Tuition reimbursement up to $5,250/year • Business-casual environment with the option to wear jeans • Paid time off program • Ten paid company holidays and three floating holidays each calendar year • Paid volunteer time — 16 hours per calendar year • Paid parental leave • Paid short- and long-term disability • Family and Medical Leave (FMLA) • Business Resource Groups (BRGs) • Flexible work environment • Reliable high-speed internet and wired connection supported for remote/hybrid work • Necessary computer equipment provided