Job Requisition ID #

24WD80874

Position Overview

The Security Incident Response Engineer is responsible for monitoring, identifying, assessing, containing and responding to various information security events in a large and complex environment, as well as analyze, triage, and report on these incidents and investigations. The candidate must have knowledge of system security design, network/cloud security best practices and in-depth knowledge of systems security operations, threat actors frequently used attack vectors, and general user behavior analytics. This position will work closely with the threat hunting and intelligence team to execute strategic vision for the department and assist in maturing our overall IR plans and policies.

• Responsible for handling day-to day operations to monitor, identity, triage and investigate security events from various Endpoint (Endpoint Detection & Response), Network and Cloud security tools and detect anomalies, and report remediation actions
• Responsible for triaging security incidents and conducting response actions to detect, contain and remediate identified security incidents
• Analyze firewall logs, server, and application logs to investigate events and incidents for anomalous activity and produce reports of findings
• Conduct reviews and analysis of proxy logs, Microsoft Windows and Active Directory logs, and malicious code to identify, contain, eradicate, and ensure recovery from incidents
• Responsible for detecting and responding to security incidents, coordinating cross-functional teams to mitigate and eradicate threats
• Responsible for handling security incidents reported by third parties or external security researchers
• Determine root cause analysis and create post-mortem report for security incidents
• Track security events and incidents in SOAR tool
• Develop and document threat driven response playbooks to support security incidents
• Maintain current knowledge and understanding of the threat landscape and emerging security threats
• Assist in the creation and maintain Autodesk Security Response Centre's process and tools documentation
• Provide support as on-call personal during security incidents
• Maintain a high level of confidentiality and Integrity

• BS in Computer Science, Information Security, or equivalent professional experience
• 3+ years of cyber security experience in incident response
• Technical depth in one or more specialties including: Malware analysis, Host analysis and Digital forensics
• Strong understanding of Security Operations and Incident Response process and practices
• Experience performing security monitoring, response capabilities, log analysis and forensic tools
• Strong understanding of operating systems including Windows, Linux and OSX
• Experience with SIEM, SOAR, EDR, Network, AWS and Azure security tools
• Experience with IR and Forensic investigations within Cloud environments such as AWS and Azure
• Experience with one or more scripting languages (PowerShell, Python, Bash, etc.)
• Excellent critical thinking and analytical skills, organizational skills, and the ability to work as part of a team
• Excellent verbal and written communication skills
• Ability to design playbooks for responding to security incidents
• Ability to support off-hours, weekends, and holidays if needed in support of incident response

• Advanced interpersonal skills to effectively promote ideas and collaboration at various levels of the organization
• One or more security-related certifications from any of the following organizations: GCIH, GCFE, GCFA, AWS, Azure Cloud security Certifications or equivalent is desired