Alert, Detection, and Response Engineer, Associate - Blackstone Cybersecurity

Blackstone • Miami, FL

7d • Onsite

About The Position

The Alert, Detection, and Response Associate is a Tier 2 incident responder on the Alert, Detection & Response team, the front line of Blackstone's cyber defense. The Associate is responsible for detecting, investigating, and responding to information security incidents across, but not limited to, email, endpoint, identity, network, and cloud. The Associate must have strong working knowledge of incident response procedures, the technology used to execute them, as well as an understanding of how to leverage AI tools effectively. The Associate manages an incident queue, carrying cases from intake through investigation, containment, and closure, and handles the escalations raised by Tier 1 analysts. Day to day the Associate works alongside the Tier 1 and Tier 2 incident response analysts on the team, taking on the harder cases and bringing in additional responders as an investigation grows. The Associate is also expected to turn what each case teaches the team into lasting improvement, feeding findings back into detections, playbooks, and automation so the same problem does not have to be worked twice. Analysts and Associates on this team are expected to play an active role in shaping investigative processes and detection capabilities, with the opportunity to see innovative ideas quickly translated into operational solutions.

Requirements

• 2+ years of hands-on experience in security operations, incident response, or a comparable technical security role
• Demonstrated experience running security investigations end to end, from alert through root cause and containment, in a SOC or IR setting
• Hands-on SIEM experience with experience writing and troubleshoot your own queries; experience with a major enterprise SIEM and its native query language (for example Splunk/SPL, Microsoft Sentinel/KQL, or Elastic)
• Hands-on EDR experience conducting endpoint investigation and containment; experience with a leading EDR platform (for example CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint)
• Working knowledge of cloud and identity investigation, including cloud audit logging, IAM, and SSO, and identity providers such as Okta or Microsoft Entra ID
• Practical understanding of attacker behavior across the intrusion lifecycle, including phishing and business email compromise, credential theft, privilege escalation, lateral movement, persistence, and exfiltration
• Familiarity with the security technologies an investigation touches: email security, endpoint protection, proxies and firewalls, DLP, and vulnerability data
• Working knowledge of MITRE ATT&CK and experience mapping observed activity to technique
• Experience scripting in Python and/or PowerShell for enrichment, parsing, and automation of repetitive analysis
• Demonstrated hands-on use of AI tooling in real work, with experience speaking in detail about several projects, professional or otherwise, where you used AI to automate or accelerate a task, and sound judgment about where its output cannot be trusted
• Clear technical writing, with experience explaining an incident and its impact to both engineers and non-technical stakeholders
• Experience self-organizing, prioritizing under time pressure, and staying accurate during a live incident

Nice To Haves

• Detection engineering experience: authoring or tuning SIEM correlation searches, EDR custom rules, or Sigma content, and measuring whether a detection actually works
• Experience with detection-as-code practices, including Git-based workflows, peer review, and CI validation of detection content
• SOAR automation experience (Torq, Splunk SOAR, Tines, or similar)
• Digital forensics capability in memory, disk, or network analysis, or hands-on malware triage and sandboxing
• Experience with agentic AI or LLM-assisted security tooling, and with AI security monitoring platforms
• Threat hunting experience, particularly hypothesis-driven hunts against endpoint or cloud telemetry
• Working knowledge of at least one major cloud platform (AWS, Azure, or GCP), including how its logging, identity, and access services are used to investigate activity in the environment
• Experience in financial services or another heavily regulated, globally distributed environment
• At least one active security certification such as Security+, GCIH, GCFA, GCIA, GCED, CySA+, or a vendor SIEM certification
• B.S. in Computer Science, Cybersecurity, Information Systems, or a related technical field

Responsibilities

• Manage an incident queue, carrying cases from intake through investigation, containment, and closure across, but not limited to, email, endpoint, identity, network, and cloud
• Handle escalations raised by Tier 1 analysts, taking on the more complex investigations and bringing in additional responders as scope grows
• Investigate in the firm's SIEM, writing and refining searches to pivot across endpoint, authentication, email, network, and cloud telemetry
• Conduct endpoint investigation, host containment, and live response in the firm's EDR platform, including process lineage, persistence review, and artifact collection
• Investigate email threats end to end, covering phishing, business email compromise, and malicious attachments and links, using header and message trace analysis to scope who was targeted and drive remediation across affected mailboxes
• Investigate cloud and identity compromise, covering credential misuse, role and privilege abuse, session hijacking, and multi-factor bypass
• Investigate third-party and SaaS provider compromise, questioning the provider's incident response team to establish containment status and what Blackstone data was affected, independently scoping the firm's exposure by hunting provider indicators across endpoint, email, network, and cloud telemetry, and coordinating findings and remediation with legal and compliance, vendor risk, and the business owners of the affected service
• Serve as a core member of the incident response team, scoping intrusions, driving containment and eradication, briefing stakeholders, and escalating in line with the firm's severity model
• Author and tune detections from investigation findings, developing the logic and validating it against historical and live data, then taking it through review into production and confirming afterward that it fires on real activity without generating unacceptable noise
• Work alongside agentic AI investigation tooling on first-pass triage and enrichment, judging its conclusions, escalating what it gets wrong, and feeding corrections back so coverage improves
• Help extend detection and response coverage across the firm's growing use of AI, an emerging and fast-moving part of the attack surface
• Turn investigation findings into lasting coverage by authoring and tuning detections, reducing false positives on noisy ones, and building automation that removes repetitive steps from triage, enrichment, and response
• Mentor Tier 1 analysts on investigation technique, sharing tradecraft through case reviews and hands-on coaching
• Document investigations and incidents to a standard that holds up under scrutiny, maintain evidence handling and chain of custody, and communicate findings clearly to technical teams and senior stakeholders
• Contribute to threat hunts and purple team exercises, using red team activity and threat intelligence to find gaps before an adversary does
• Participate in incident response and the SOC on-call rotation (occasional, roughly quarterly) to respond to escalated security incidents

Benefits

• Comprehensive health benefits, including but not limited to medical, dental, vision, and FSA benefits
• Paid time off
• Life insurance
• 401(k) plan
• Discretionary bonuses
• Equity and other incentive compensation

What This Job Offers

• Job Type: Full-time
• Career Level: Entry Level