Security Incident Response Engineer

With an eye for detail and a contagiously positive attitude, you’re the teammate everyone counts on to get the project buttoned up and across the finish line.

Schaumburg, IL

CONNECTION

<p><strong>At Connection, our purpose is simple: we connect people with technology. From hardware&mdash;PCs, printers, servers, and more&mdash;to cutting-edge cloud, cybersecurity, and professional IT services, we design, build, and support the IT solutions that thousands of companies, schools, and government agencies rely on every day. We like to think of ourselves as the IT Department for our customers&rsquo; IT Department. Our company started out almost 40 years ago with two employees and a phone line. Today we&rsquo;re a Fortune 1000 IT solutions partner operating in 174 countries around the world&mdash;still driven by that startup mentality and guided by our original purpose.</strong></p> https://www.connection.com/

keywords: position summary,what we do,who we are,why you should join us,incident response,documentation,collaboration,continuous improvement,support,operations,experience,skills

Full Time

$93,000.00/Yr. - $119,862.00/Yr.

Overview: <strong>What We Do:</strong><br /><br />We calm the confusion of IT by guiding the connection between people and technology. If a customer is looking for a better way to manage their warehouse inventory, equip their workforce, or secure their data, we make it happen. All it takes is finding the right combination of tech hardware, software, cloud solutions, and support services. That&rsquo;s what we do. We&rsquo;re the IT Department&rsquo;s IT Department.<br /> <br /><strong>Who We Are:</strong><br /><br />Our team is made stronger by a multitude of backgrounds, experiences, and perspectives. It&rsquo;s what makes Connection unique&mdash;what drives us to innovate and create technology solutions that stand apart from the crowd. We&rsquo;d love for you to be a part of that fabric, to share your ideas and experiences with a team that thrives on fresh thinking, creativity, and helping others.<br /> <br /><strong>Why You Should Join Us:</strong><br /><br />You&rsquo;ll find supportive teammates and a rewarding career at Connection&mdash;plus great benefits. We take pride in supporting employees with a total rewards package that provides financial, emotional, and physical resources for you and your family. Our compensation, 401k plans, medical insurance, and other benefits are progressive and competitive. We value the importance of our employees&rsquo; emotional well-being. To support employees, we provide free therapy visits, mental health coaching and tools, and meditation resources. You&rsquo;ll also enjoy a generous paid time off package that includes not only vacation and sick time, but also Wellness and Volunteer Time Off days.<br /><br /><br />The Security Incident Response Engineer (SIRE) plays a crucial role in supporting security operations within the Hybrid Command Center. The SIRE focuses on responding to security alerts, assisting in incident investigations, and ensuring that emerging threats are addressed promptly and effectively. The SIRE works as part of a larger team to maintain the security posture of the organization, collaborating closely with HCC engineers, network, cloud, and SOC teams.
Responsibilities: <strong>Incident Response:</strong><br /><br /> <ul> <li>Assists junior team members with the monitoring of security alerts and events through SIEM tools, IDS/IPS, and endpoint detection systems.</li> <li>Escalates critical incidents to the Lead Security Engineer and relevant teams.</li> <li>Executes containment, eradication, and recovery actions under the guidance of the team lead.</li> <li>Coordinates with client teams and internal network, cloud, and infrastructure teams to implement corrective measures to restore security after an incident has been detected.</li> </ul> <br /><strong>Alert Prioritization and Triage:</strong><br /><br /> <ul> <li>Reviews and analyzes alerts escalated from first responders' initial triage to determine severity and validity.</li> <li>Prioritizes alerts based on risk impact and operational guidelines.</li> <li>Documents actions taken in ticketing or incident tracking systems.</li> </ul> <br /><strong>Threat Intelligence Support:</strong><br /><br /> <ul> <li>Assists in tracking emerging threats and vulnerabilities relevant to the organization.</li> <li>Provides input to vulnerability assessments and patch recommendations.</li> <li>Participates in proactive threat-hunting activities to detect suspicious activity.</li> </ul> <br /><strong>Security Tool Management and Operations:</strong><br /><br /> <ul> <li>Operates SIEM, EDR, firewalls, and other security tools to monitor network activity.</li> <li>Assists in maintaining and fine-tuning security monitoring tools for optimal performance.</li> <li>Collaborates with vendors or third parties for troubleshooting and maintenance of security solutions.</li> </ul> <br /><strong>Incident Documentation and Reporting:</strong><br /><br /> <ul> <li>Prepares detailed incident reports, documenting events, findings, and remediation steps.</li> <li>Participates in post-incident reviews to identify lessons learned and recommend improvements.</li> <li>Maintains accurate records to ensure compliance with SLAs and security frameworks.</li> <li>Assists with playbook creation for security event handling.</li> <li>Provides insight and recommendations for security improvements to client networks.</li> </ul> <br /><strong>Collaboration and Coordination:</strong><br /><br /> <ul> <li>Works closely with the SOC, IT, and network operations teams to address client security issues.</li> <li>Participates in cross-functional meetings to align security priorities.</li> <li>Supports incident response tabletop exercises and security awareness efforts.</li> </ul> <br /><strong>Continuous Learning and Development:</strong><br /> <ul> <li>Stays informed on new security technologies, trends, and best practices.</li> <li>Participates in training programs and professional development initiatives as directed.</li> <li>Works toward certifications relevant to the role, such as CompTIA Security+, CEH, or GSEC.</li> </ul>
Requirements: <ul> <li>Technical Proficiency: Familiarity with SIEM, IDS/IPS, EDR tools, network, server infrastructure, and firewalls.</li> <li>Analytical Skills: Strong ability to assess alerts and distinguish between legitimate incidents and false positives.</li> <li>Communication: Clear verbal and written skills to document incidents and report findings effectively.</li> <li>Collaboration: Ability to work effectively within a team and across departments.</li> <li>Problem Solving: Quick thinking to assist with real-time incident response.</li> <li>Knowledge of Security Standards: Basic understanding of NIST, ISO 27001, and CIS Controls.</li> <li>Experience in security operations or working within a SOC environment.</li> <li>Familiarity with incident response frameworks and threat-hunting methodologies.</li> <li>Relevant certifications such as CompTIA Security+, Certified Ethical Hacker (CEH), or GIAC Security Essentials (GSEC) preferred.</li> </ul> <br />