IT - Incident Response Engineer

Eaton Corporation•Coraopolis, PA

2d•$113,000 - $165,000

About The Position

Eaton’s Corporate Sector is hiring an IT Incident Response Engineer to serve as a senior member of its Cyber Security Incident Response Team (CSIRT). The role identifies, analyzes, and responds to advanced cyber threats across on-premises, hybrid, and multi-cloud environments, protecting Eaton’s intellectual property, operational technology, cloud workloads, and brand in a complex, global, regulated business environment. The engineer also advances the team’s capabilities in agentic AI, automation, detection engineering, and insider threat program work. The position is responsible for engineering and improving detection and response capabilities across cloud and on-premises environments. It includes hands-on incident response, threat hunting, cloud security, digital forensics, security engineering, SIEM content and architecture, and development of automation and AI-enabled tooling. The position provides 24/7/365 incident response through an on-call rotation. It can be based in Beachwood, Ohio, or Moon Township, Pennsylvania, and candidates generally must reside within 50 miles of a work location; active-duty military are exempt. No relocation assistance is offered. Applicants must meet ITAR U.S.-person requirements and be authorized to work in the United States without current or future company sponsorship.

Requirements

Bachelor’s degree from an accredited institution.
At least seven years of experience in security operations, incident response, cloud security, eDiscovery, insider threat, security engineering, or a related field.
Must be a U.S. person as defined by ITAR: a U.S. citizen, U.S. permanent resident, political asylee, or refugee.
Must be legally authorized to work in the United States without company sponsorship now or in the future.
Candidates must currently reside within 50 miles of Beachwood, OH, or Moon Township, PA; active-duty military are exempt from this geographical limitation.
Exceptional written and verbal communication skills in English.
Strong analytical and problem-solving skills.
Strong project management, multitasking, and organizational skills.
Ability to communicate technical findings in clear, business-relevant language and to communicate incident status, risk, and impact accurately and transparently under pressure.
Ability to produce clear, concise written deliverables and present credibly to senior leadership.
Demonstrated ability to foster honest communication and build trust with teams and stakeholders.
Proven ability to mentor and upskill junior analysts.

Nice To Haves

Hands-on experience leading or performing cyber security incident response, including containment, remediation, and recovery.
Hands-on cloud security experience with one or more major platforms.
Experience correlating events from multiple sources, including cloud-native sources, to detect suspicious or malicious activity.
Detection engineering experience and SIEM content development and architecture experience.
Experience building automation and/or agentic AI workflows, including SOAR, Python or PowerShell scripting, and AI agents.
Working knowledge of AI/LLM security concepts and risks associated with enterprise AI adoption.
Experience with digital forensics and eDiscovery tools and methodologies.
Solid understanding of adversary TTPs and the MITRE ATT&CK framework.
Ability to comprehend complex technical infrastructure, managed services, and third-party dependencies.
Strong analytical and problem-solving skills.

Responsibilities

Provide 24/7/365 cyber incident response through an on-call rotation, including response, containment, remediation, and recovery across the global enterprise.
Investigate and resolve information security issues in accordance with compliance, regulatory, and investigative standards.
Manage and coordinate responses to malicious cyber activity affecting or targeting Eaton’s IT, cloud, and operational technology environments.
Conduct proactive threat hunting based on emerging indicators of compromise, vulnerabilities, and threat intelligence.
Lead detection, investigation, and response for cloud security incidents across Microsoft Azure, AWS, and/or Google Cloud, including identity, workload, container, and SaaS compromise scenarios.
Develop and tune cloud-native detections using cloud logging and telemetry.
Apply knowledge of cloud identity and access management, misconfigurations, and cloud attack paths to improve detection coverage and reduce exposure.
Partner with cloud platform and engineering teams to embed security into cloud architecture and support CSPM and workload protection initiatives.
Track relevant threat actors and campaigns and enrich incidents with contextual intelligence.
Design, build, and enable agentic AI and automation workflows, including SOAR, scripting, and AI agents, for triage, investigation, containment, and reporting.
Develop and maintain automated playbooks to reduce mean time to detect and respond and eliminate repetitive manual work.
Assess AI/LLM systems and agents for security risks and support evaluation of AI-enabled SOC and managed-services capabilities.
Conduct digital forensic analysis and eDiscovery for incident response, internal investigations, and legal or compliance requests while preserving evidence and chain of custody across endpoint and cloud sources.
Deploy, configure, manage, and update security tools across cloud and on-premises environments.
Develop advanced queries, correlation rules, and detections to improve detection coverage and security posture.
Contribute to SIEM architecture, including cloud log onboarding, normalization, content lifecycle, and tuning to focus detection operations and reduce false positives.
Communicate incident status, risk, impact, and technical findings clearly to technical teams, junior analysts, executives, and non-technical audiences.
Produce clear written deliverables, including incident reports, executive briefings, and documentation.
Mentor and upskill junior analysts.