Incident Response Engineer II

Job Description:
We are seeking an experienced Security Incident Response Engineer to join our Security Operations team. The ideal candidate will be responsible for responding to security incidents, analyzing threats, and improving detection and response capabilities across enterprise systems.

Key Responsibilities:

• Lead and manage security incidents, investigations, and response activities

• Monitor and analyze security logs using SIEM tools (Microsoft Sentinel)

• Develop detection rules, dashboards, and threat hunting queries using KQL

• Automate incident response workflows using Logic Apps and SOAR tools

• Conduct vulnerability assessments and support remediation efforts

• Investigate endpoint threats using EDR tools such as Microsoft Defender

• Prepare incident reports and maintain response runbooks

• Collaborate with infrastructure and security teams to improve overall security posture

• Participate in on-call rotation for incident response

Required Skills:

• 5+ years of experience in Incident Response / Security Operations

• Strong experience with Microsoft Sentinel (SIEM/SOAR) and KQL queries

• Hands-on experience with Microsoft Defender for Endpoint

• Knowledge of TCP/IP networking and security monitoring tools

• Experience with vulnerability management and threat hunting

• Scripting skills (PowerShell, Python, Bash) preferred

Preferred:

• Experience with Azure security services, Azure AD, and Identity & Access Management

• Relevant certifications such as SANS, ISC2, or Microsoft Security