Principal Cybersecurity Incident Response Engineer

Wells Fargo•Chandler, AZ

About The Position

Wells Fargo is seeking a Principal Engineer in Technology as part of Cybersecurity. The Tier 3 Principal Cybersecurity Incident Response Engineer serves as a senior technical escalation point for complex, high-impact, and potentially enterprise-significant cybersecurity incidents. The role provides advanced investigation, containment, remediation, and technical leadership while helping mature incident response capabilities across the organization. Tier 3 work goes beyond initial triage and investigation, focusing on incidents requiring deeper technical analysis, cross-functional coordination, and development of repeatable detection and response capabilities. The role leads investigations, guides other responders, develops recommendations for containment, eradication, and recovery, and coordinates technical response activities with relevant teams. It also uses telemetry and threat intelligence to identify attacker behavior, contributes to detection and response improvements, and partners with engineering and security platform teams to improve security visibility and response effectiveness. The position includes mentoring analysts, developing playbooks and reusable methods, and participating in exercises, reviews, and root cause analysis. The engineer is expected to use AI-assisted development and analysis tools responsibly, validate their outputs, account for model limitations and risks, and ensure use aligns with security, compliance, privacy, and ethical standards. The role also carries applicable risk and compliance responsibilities, including following company policies, escalating and remediating issues, and making sound risk decisions.

Requirements

7+ years of Engineering experience, or equivalent demonstrated through one or a combination of work experience, training, military experience, or education.
Demonstrated proficiency in AI-assisted development and analysis tools, such as GitHub Copilot and approved code-centric agents.
Ability to apply technical judgment when validating and integrating AI-assisted outputs and account for model limitations, security risks, and operational considerations.
Ability to use AI responsibly in development and production environments in alignment with security, compliance, privacy, and ethical standards.

Nice To Haves

Experience leading incident response during major incidents.
Experience with enterprise incident response and security operations.
Experience investigating incidents with endpoint detection and response (EDR) and extended detection and response (XDR) tools.
Experience with security information and event management (SIEM) tools and large-scale log analysis.
Knowledge and understanding of network and endpoint forensics.
Experience with identity and authentication investigations.
Experience with cloud security investigations.
Knowledge and understanding of malware analysis and attacker tactics, techniques, and procedures.
Knowledge and understanding of the MITRE ATT&CK framework.
Experience with threat intelligence.
Experience with detection engineering and threat hunting.
Experience with scripting or automation for security investigations.
Experience with major incident and ransomware response.
Ability to take ownership of technically ambiguous problems.
Ability to drive investigations from initial escalation through resolution.
Ability to communicate complex technical findings clearly to technical and nontechnical stakeholders.
Ability to influence teams without relying on positional authority.
Ability to mentor less experienced responders.
Ability to turn individual incidents into broader improvements in defensive capability.
Ability to engage effectively with cybersecurity engineering, technology, risk, and external security partners.
Ability to navigate and express confidence to the larger team during high-stress situations.

Responsibilities

Lead technical investigation of complex and high-severity cybersecurity incidents, determining scope, attack path, affected assets, and potential business impact.
Serve as an escalation point for Tier 1 and Tier 2 analysts and provide technical guidance during complex investigations.
Develop containment, eradication, and recovery recommendations and coordinate technical response activities with security, infrastructure, application, and other appropriate teams.
Support major incident and crisis response activities when required.
Correlate endpoint, network, identity, cloud, application, and security telemetry to identify attacker behaviors, persistence mechanisms, lateral movement, and indicators of compromise.
Apply threat intelligence and attacker tactics, techniques, and procedures to active investigations, translating findings into actionable detection and response opportunities.
Identify gaps exposed through incidents and investigations and develop or recommend detection logic, investigative techniques, response procedures, and automation opportunities.
Partner with engineering and security platform teams to improve visibility and response effectiveness and help operationalize cybersecurity technologies and capabilities.
Mentor analysts, facilitate knowledge transfer, develop investigation playbooks and documentation, and provide technical leadership without requiring formal people-management responsibilities.
Participate in tabletop exercises, simulations, after-action reviews, and root cause analysis, translating lessons learned into measurable improvements.
Evaluate emerging technologies and techniques that could strengthen incident response capabilities.
Use AI-assisted tools to accelerate system design, coding, testing, analysis, and troubleshooting; validate and integrate their outputs with sound technical judgment.
Account for AI model limitations, security risks, and operational considerations, and apply AI responsibly in development and production in alignment with security, compliance, privacy, and ethical standards.
Follow applicable risk programs, Wells Fargo policies and procedures, and risk and compliance obligations; escalate and remediate issues and make sound risk decisions.