Lead Security Incident Response Engineer - PCC

Elegant solutions to sophisticated problems. That’s what you deliver. Surround yourself with the team, resources, and support you need to design and build world-class IT solutions.

Schaumburg, IL

CONNECTION

<p><strong>At Connection, our purpose is simple: we connect people with technology. From hardware&mdash;PCs, printers, servers, and more&mdash;to cutting-edge cloud, cybersecurity, and professional IT services, we design, build, and support the IT solutions that thousands of companies, schools, and government agencies rely on every day. We like to think of ourselves as the IT Department for our customers&rsquo; IT Department. Our company started out almost 40 years ago with two employees and a phone line. Today we&rsquo;re a Fortune 1000 IT solutions partner operating in 174 countries around the world&mdash;still driven by that startup mentality and guided by our original purpose.</strong></p> https://www.connection.com/

keywords: position summary,what we do,who we are,why you should join us,teamwork,security,compliance,performance,technical,skills,experience,knowledge

Full Time

$117,692.00/Yr. - $153,000.00/Yr.

Overview: <strong>What We Do:</strong><br /><br />We calm the confusion of IT by guiding the connection between people and technology. If a customer is looking for a better way to manage their warehouse inventory, equip their workforce, or secure their data, we make it happen. All it takes is finding the right combination of tech hardware, software, cloud solutions, and support services. That&rsquo;s what we do. We&rsquo;re the IT Department&rsquo;s IT Department.<br /> <br /><strong>Who We Are:</strong><br /><br />Our team is made stronger by a multitude of backgrounds, experiences, and perspectives. It&rsquo;s what makes Connection unique&mdash;what drives us to innovate and create technology solutions that stand apart from the crowd. We&rsquo;d love for you to be a part of that fabric, to share your ideas and experiences with a team that thrives on fresh thinking, creativity, and helping others.<br /> <br /><strong>Why You Should Join Us:</strong><br /><br />You&rsquo;ll find supportive teammates and a rewarding career at Connection&mdash;plus great benefits. We take pride in supporting employees with a total rewards package that provides financial, emotional, and physical resources for you and your family. Our compensation, 401k plans, medical insurance, and other benefits are progressive and competitive. We value the importance of our employees&rsquo; emotional well-being. To support employees, we provide free therapy visits, mental health coaching and tools, and meditation resources. You&rsquo;ll also enjoy a generous paid time off package that includes not only vacation and sick time, but also Wellness and Volunteer Time Off days.<br /><br />The Lead Security Incident Response Engineer is responsible for incident response and management, monitoring and alert handling, security operations management, threat intelligence and mitigation, policy and compliance management, as well as training and mentoring junior engineers.
Responsibilities: <strong>Incident Response, Management, and Coordination:<br /></strong><br /> <ul> <li>Leads investigations of security breaches, attacks, or incidents.</li> <li>Coordinates with internal and external teams to mitigate ongoing attacks.</li> <li>Oversees post-incident review sessions with clients and recommend corrective actions.</li> <li>Develops and executes incident response plans ensuring appropriate stakeholders are informed and involved.</li> <li>Maintains communication with defined key stakeholders during an active incident.</li> </ul> <br /><strong>Monitoring and Alert Handling:</strong><br /><br /> <ul> <li>Works with SOC teams to develop and fine tune Security Information and Event Management (SIEM) systems for monitoring client networks.</li> <li>Analyzes alerts from firewalls, intrusion detection systems (IDS), and other tools as needed</li> <li>Prioritizes alerts and determine severity, providing actionable recommendations to security teams.</li> <li>Stays updated on emerging threats, vulnerabilities, and attach techniques in order to integrate in the team's detection and response strategies.</li> </ul> <br /><strong>Security Operations Management:<br /></strong><br /> <ul> <li>Assigns tasks, prioritize incidents, and leads the team&rsquo;s response during threat analysis and incident handling.</li> <li>Ensures compliance with operational procedures and service level agreements (SLAs).</li> <li>Collaborates with the SOC (Security Operations Center) to address potential risks and vulnerabilities.</li> <li>Provides guidance and technical direction during active security incidents.</li> <li>Conducts post-incident team meetings to review lessons learned and increase the team's effectiveness.</li> </ul> <br /><strong>Threat Intelligence and Mitigation:</strong><br /> <br /> <ul> <li>Stays updated on emerging threats, vulnerabilities, and attack vectors.</li> <li>Works with SOC teams to ensure accurate detection and response strategies are in place.</li> <li>Conducts vulnerability assessments and recommend patches or mitigation strategies.</li> <li>Coordinates penetration tests and red team exercises to assess security posture.</li> </ul> <br /><strong>Policy and Compliance Management:</strong><br /><br /> <ul> <li>Ensures compliance with relevant standards (e.g., ISO 27001, NIST, GDPR, SOC2, HIPAA).</li> <li>Implements and enforces security policies, procedures, and governance frameworks.</li> <li>Collaborates with audit and compliance teams to prepare reports.</li> </ul> <br /><br /><strong>Training and Development:<br /></strong><br /> <ul> <li>Mentors junior engineers and analysts and provides guidance on security best practices.</li> <li>Conducts security awareness training for technical and non-technical staff.</li> <li>Facilitates tabletop exercises and incident response drills for the organization.</li> </ul> <br /><strong>Collaboration Across Teams:</strong><br /><br /> <ul> <li>Works closely with IT, DevOps, network, and business teams to align security efforts.</li> <li>Coordinates with third-party vendors, and/or regulatory bodies as needed.</li> <li>Acts as a point of contact for escalations regarding.</li> </ul>
Requirements: <ul> <li>Proficiency in security tools such as SIEMs, firewalls, IDS/IPS, endpoint detection and response (EDR), and vulnerability management tools.</li> <li>Strong leadership and team management skills to coordinate efforts across internal and external security teams.</li> <li>Ability to translate complex technical security findings into business-level reports and communicate with both technical and non-technical stakeholders.</li> <li>Analytical mindset for diagnosing issues and quickly addressing security incidents.</li> <li>Familiarity with frameworks such as NIST, CIS Controls, ISO 27001, and regulatory requirements.</li> <li>Experience working as a mentor of a team.</li> <li>CISSP, CEH, CCSP, SANS GIAC, SANS GCIH, or other vendor specific security certifications preferred.</li> </ul>