Incident Management and Response Engineer

Construction Resources•Decatur, GA

1d•Hybrid

About The Position

The Incident Management & Response Engineer is responsible for developing and maintaining the Incident Management (pre-incident) and Incident Response (post-incident) programs of Construction Resources and its affiliates (CR), to ensure that the company's information systems and information assets are adequately monitored and responded to when an attack on, or critical outage of, the CR infrastructure occurs. The Incident Management & Response Engineer will work with other IT leaders to report, review and mitigate the events/incidents that may or have impacted CR’s IT infrastructure systems. The functional scope of this role includes event management of CR’s IT security systems through the correlation of events and managing any incidents, through discovery, remediation, and communications, to drive a quick recovery of systems and data following an incident.

Requirements

Security knowledge across various security domains and technologies (e.g., databases, operating systems, networking, applications, data management, access management, and identity management)
Experience executing security hunting activities to determine possible vulnerabilities or incidents within the IT environment
Maintain up-to-date understanding of technology trends and developments in the areas of information technology and security
Ability to understand business processes and needs, gain buy-in and influence change
Ability to drive execution of defined goals through effective interaction with IT services teams
Ability to frame security and IT vulnerability-related concepts to both technical and non-technical audiences
Highly developed analytical, structured problem-solving skills; analytics and inquisitive mind-set
Knowledge in Information Security, IT Risk, IT Auditing
Deep understanding of MITRE ATT&CK Framework
Bachelor's degree is required; degree in computer science, information systems, information security, business administration, or another related field preferred
4+ years relevant experience in related fields, qualifying experience could be obtained through roles in security operations center (SOC), cloud security, information technology administration/management, data center management and/or end-user computing.
Familiarity with Incident Management and Incident Response frameworks required.
Experience in establishing and documenting processes and procedures, and communicating service to relevant teams across the business landscape
Expertise and professional experience working in Windows and Linux environments
Experienced and knowledgeable regarding Cloud infrastructure and security capabilities, including Microsoft Azure
Strong communication skills with the ability to talk with business and technical parties across all levels of the organization
Strong time management skills and experience handling multiple assignments with competing priorities
Ability to lead large, disparate teams during stressful situations
Strong analytical and technical skills

Nice To Haves

Incident Management training, i.e. ISO 27035, preferred.
CISM, CISA, and/or GIAC certifications preferred.

Responsibilities

Establish, maintain, and communicate a clear and comprehensive Incident Management & Response (IR) programs aligned to industry standard framework(s); own the program as a leader and be the main point of contact and subject matter expert
Implement, define and improve CR policies, standards, and procedures of Incident Management & Response services, including: incident management processes and procedures (hunting, event correlation, etc.), incident response processes and procedures, and tabletop exercises for incident responses
Provide ticketing standards and escalation requirements for security or critical outage events and incidents
Provide documents that outline incident protocols such as how to handle cybersecurity threats or how to correct server failures
Keep abreast of relevant trends and threats, and translate these for CR to allow for mitigation activities where possible
Responding to a reported service incident, identifying the cause, and initiating the incident management process
Escalating within the team if major issues are found in the IT system
Establish and drive metrics, analytics, reporting mechanisms and services, maturity models and a roadmap for continual IR program improvements
Facilitate compliance with the CR policies and external regulations
Prepare formal reports and presentations of findings and recommendations
Author Incident Management/Incident Response guidelines, principles, policies, and standards for information / data stewards, stakeholders, and development teams
Other duties, as assigned