Information Security Engineer - Principal

Independence Pet Group•Chicago, IL

12h

About The Position

Independence Pet Holdings is seeking an experienced security operations professional for a hands-on technical role focused on incident response, threat intelligence, and forensic investigations across cloud and legacy environments. The position supports a unified enterprise security operations model, including SIEM and detection tooling, advanced threat intelligence, and automated response processes. The role requires strong Microsoft Azure and Microsoft 365 security experience and the ability to investigate complex incidents, communicate findings clearly, drive remediation, and coordinate across Security Engineering, Security Operations, GRC, Infrastructure, Cloud, DevOps, application, and business teams. The position reports to the Director of Security Operations and also provides quality review and escalation support for repeatable work performed by offshore or managed-service partners. The role leads threat intelligence and adversary analysis; advanced security monitoring and incident investigations; digital forensics and evidence preservation; proactive threat hunting and detection engineering; and technical incident response and cyber crisis support. It also supports the optimization of Microsoft Sentinel, Microsoft XDR, Defender products, Entra ID, CrowdStrike, and related security operations technologies. As a senior technical subject matter expert, the role develops playbooks and procedures, mentors analysts and partners, and produces professional investigation documentation and executive briefings. The employer describes the position as eligible for healthcare and other benefits, with some offerings depending on work location. The stated base pay ranges are $187,899–$234,873 per year in Chicago and $170,871–$213,521 per year nationwide. The position is not eligible for an annual bonus.

Requirements

Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Digital Forensics, Information Assurance, or a related discipline; equivalent professional experience may be considered.
At least 10 years of progressive experience in Security Operations, Threat Intelligence, Incident Response, Threat Hunting, Digital Forensics, or Cyber Defense roles within enterprise environments.
Demonstrated experience investigating ransomware, business email compromise, insider threats, account compromise, malware infections, cloud security incidents, APTs, and data exfiltration.
Advanced knowledge of threat intelligence collection, enrichment, analysis, and operationalization using commercial providers, sharing groups, OSINT, and internal telemetry.
Strong understanding of adversary TTPs and experience using frameworks such as MITRE ATT&CK, Cyber Kill Chain, Diamond Model, and ATT&CK Navigator.
Experience converting threat intelligence into detections, hunting hypotheses, correlation rules, watchlists, automated response actions, and security control enhancements.
Deep digital forensic investigation experience across endpoints, servers, Microsoft 365, Azure, cloud workloads, email platforms, identity systems, and hybrid environments.
Hands-on expertise in forensic evidence acquisition and preservation, chain-of-custody management, timeline construction, artifact analysis, memory analysis, malware triage, and root-cause determination.
Strong analytical skills and experience correlating endpoint telemetry, cloud logs, authentication records, network activity, SIEM data, threat intelligence, and forensic artifacts.
Extensive experience conducting proactive threat hunts across Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, CrowdStrike, Microsoft 365, Entra ID, Azure, cloud platforms, and network security data.
Expertise developing SIEM analytics rules, behavioral detections, KQL hunting queries, automation workflows, enrichment logic, and investigation playbooks.
Hands-on experience with Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, Defender for Cloud, Defender for Identity, Microsoft Purview, Entra ID, and related security monitoring platforms.
Strong understanding of log analysis, packet analysis, endpoint investigations, cloud security monitoring, attack-path analysis, and forensic validation.
Experience leading technical incident response, including containment, eradication, recovery, evidence preservation, executive communications, and post-incident reviews.
Experience producing forensic reports, threat intelligence assessments, attack narratives, executive briefings, and technical documentation for legal, audit, compliance, and leadership audiences.
Knowledge of regulatory and compliance requirements for investigations, evidence handling, audit readiness, data protection, breach response, and regulatory reporting.
Strong understanding of NIST Cybersecurity Framework, NIST 800-61, NIST 800-86, NIST 800-53, MITRE ATT&CK, CIS Controls, ISO 27001, and ISO 27035.
Excellent written and verbal communication skills, including the ability to communicate technical findings and risk impacts to technical and non-technical stakeholders.
Ability to act as a senior technical escalation resource, mentor junior analysts, and provide quality oversight for offshore teams, MSSPs, and security operations partners.
Strong attention to detail, intellectual curiosity, investigative mindset, and ability to independently manage high-priority investigations while balancing concurrent security events.

Responsibilities

Lead the collection, analysis, and operationalization of cyber threat intelligence from internal telemetry, commercial providers, OSINT, and industry sharing groups.
Analyze adversary tactics, techniques, and procedures using frameworks such as MITRE ATT&CK, and translate intelligence into detections, monitoring requirements, investigations, and security control improvements.
Develop intelligence reports, threat briefs, and executive summaries describing emerging threats, risk trends, adversary activity, and potential business impacts.
Track industry-specific threats affecting insurance, financial services, healthcare, cloud platforms, and software supply chains.
Partner with Security Engineering and Security Architecture to incorporate threat intelligence into detection logic, control design, policies, and incident response processes.
Lead investigations involving suspicious activity, account compromise, insider threats, ransomware, malware, cloud attacks, phishing, business email compromise, data exfiltration, and unauthorized access.
Analyze security alerts and correlate logs, endpoint telemetry, cloud activity, authentication records, and threat intelligence to determine attack scope, impact, and root cause.
Serve as an escalation point for complex investigations requiring cross-platform analysis or forensic validation.
Conduct forensic investigations across endpoints, servers, Microsoft 365, Azure, identity platforms, email systems, cloud workloads, and hybrid environments.
Acquire, preserve, analyze, and document digital evidence while maintaining chain-of-custody requirements and evidentiary integrity.
Perform memory analysis, artifact collection, timeline reconstruction, log validation, malware triage, and root-cause investigations.
Produce forensic findings reports documenting attack timelines, affected assets, threat activity, business impact, and recommended remediation.
Support legal, compliance, audit, and regulatory response activities requiring technical evidence and forensic documentation.
Design and execute proactive threat hunts across Azure, Microsoft 365, Sentinel, Microsoft XDR, Defender for Endpoint, Entra ID, network telemetry, and cloud application logs.
Develop and improve detection logic, correlation rules, behavioral analytics, watchlists, and hunting queries based on emerging threats and intelligence.
Identify detection gaps and recommend monitoring capabilities to improve cloud, endpoint, identity, and network visibility.
Lead technical response during cybersecurity incidents, coordinating containment, eradication, recovery, and post-incident analysis.
Guide response to ransomware, credential compromise, data breaches, insider threats, cloud security incidents, and advanced persistent threat activity.
Facilitate technical war rooms and provide timely updates to leadership, technology teams, legal stakeholders, and executive management.
Document incidents, investigative findings, response actions, lessons learned, and remediation recommendations.
Participate in incident response exercises, tabletop simulations, and cyber resilience testing.
Support and continuously improve Microsoft Sentinel, Microsoft XDR, Defender for Endpoint, Defender for Cloud, Entra ID, CrowdStrike, and related technologies.
Create dashboards, automated workflows, enrichment processes, and case management integrations to improve investigation speed and analyst effectiveness.
Tune detections, reduce false positives, standardize triage, and mature enterprise security operations.
Develop metrics and reporting for detection performance, investigation quality, containment effectiveness, MTTA, and MTTR.
Provide quality review, mentoring, and escalation support for analysts, offshore resources, MSSPs, and security operations partners.
Develop investigation playbooks, forensic procedures, threat-hunting methodologies, standard operating procedures, and analyst training materials.
Maintain incident reports, forensic reports, threat profiles, attack-path analysis, runbooks, diagrams, and executive briefings.
Stay current on emerging threats, attack techniques, cloud security risks, adversary campaigns, and cybersecurity best practices.