Job Title: Engineer - Security Operations and Incident Response
Location: USA or Canada (Remote or Hybrid)
Description
This role is a critical function responsible for the ongoing transformation of the organization’s Security Operations & Incident Response program. With a focus on maintaining resilience and protecting the global enterprise from cybersecurity threats, the team operates an advanced security operations and incident response program focused on the identification, analysis, and eradication of cybersecurity threats and incidents across the global enterprise. In support of the rapid growth of this critical program, we are looking for an experienced, passionate, and highly organized engineer who will drive operational delivery excellence and continuous advancement across processes and technologies.
Primary Responsibilities
- Expert-level support for deep dive investigations, including digital forensics (memory, network, and malware analysis).
- Author and refine IR playbooks and operational guidelines to ensure the team remains agile in an evolving threat landscape.
- Develop and maintain threat models, incorporating findings from penetration tests into detection strategies.
- Design, implement, and refine complex detection rules and automated remediation workflows to identify adversarial behavior.
- Utilize threat intelligence and the MITRE ATT&CK framework to identify gaps in visibility and proactively mitigate emerging risks.
- Maintain comprehensive documentation of detection strategies, active investigations, and incident timelines.
- Work with the SIEM team to continuously tune SIEM rules to maximize detection fidelity while minimizing alert fatigue.
- Review and tune threat intelligence systems, including brand protection and dark web monitoring.
- Proficiency in scripting and query building using Python, XQL, PowerShell, or Bash, and experience with automation and/or orchestration (SOAR) tools.
- Support IR leadership as backup on IR-related activities.
Qualifications
- Bachelor’s degree and 5+ years of relevant experience in incident response and SOC tooling.
- In-depth knowledge of SIEM/SOAR platforms (e.g., Microsoft Sentinel, Palo Alto Cortex XSIAM/XSOAR) and incident response processes in hybrid cloud environments (GCP, Azure).
- Experience leading incident response as incident commander, performing root cause analysis and continuous optimization for SOC tools and processes.
- Familiarity with scripting languages (Python, PowerShell, Bash, XQL) is highly preferred.
- Understanding of regulatory compliance and frameworks such as MITRE ATT&CK, NIST, or ISO.
- Ability to prioritize tasks effectively, manage multiple priorities, and work both independently and as part of a team.
- Strong communication skills, with the ability to translate sophisticated technical issues or concepts to non-technical audiences in a clear and concise manner that focuses on business value.
Skills Required
- Bachelor's degree
- 5+ years of relevant experience in incident response and SOC tooling
- In-depth knowledge of SIEM and SOAR platforms
- Experience with incident response processes in hybrid cloud environments
- Experience with Microsoft Sentinel or Palo Alto Cortex XSIAM/XSOAR
- Experience leading incident response as an incident commander
- Experience performing root cause analysis and optimizing SOC tools and processes
- Familiarity with Python, PowerShell, Bash, or XQL
- Understanding of MITRE ATT&CK, NIST, or ISO frameworks
- Ability to prioritize tasks and manage multiple priorities
- Ability to work independently and as part of a team
- Strong communication skills, including explaining technical concepts to non-technical audiences
What We Do
We help enterprise organizations design, implement, and sustain their most critical security and technology programs. Our work spans four core disciplines: cybersecurity solution design and delivery across IAM, Data Security, Network Security, Threat & Vulnerability Management, CDR & Application Security, GRC & Compliance, AI Security, Quantum Security, and OT Security; program and project management that keeps complex, multi-stakeholder initiatives on track; organizational change management that drives people-side adoption and ensures technology investments deliver lasting value; and M&A advisory and integration support that helps organizations navigate technology and security through the full transaction lifecycle. We don't hand off a roadmap and walk away — we stay in it with our clients through execution, transition, and long-term success.
Why Work With Us
At Pearl, you get the rigor of a premium consultancy and the ownership of a boutique firm. Work across cybersecurity delivery, program management, OCM, and M&A. Grow into new practice areas, wear multiple hats, and have a real voice in how we evolve.
Gallery
