Principal Cybersecurity Incident Response Engineer

Wells Fargo Bank•Chandler, AZ

About The Position

Wells Fargo is seeking a Principal Engineer in Technology within Cybersecurity. The Tier 3 Principal Cybersecurity Incident Response Engineer serves as a senior technical escalation point for complex, high-impact, and potentially enterprise-significant cybersecurity incidents. The role provides advanced investigation, containment, remediation, and technical leadership while helping mature incident response capabilities across the organization. Tier 3 work goes beyond initial triage and investigation, focusing on incidents requiring deeper technical analysis, cross-functional coordination, and development of repeatable detection and response capabilities. The position also provides technical leadership without requiring formal people-management responsibilities. It supports major incident and crisis response when required, helps turn investigative findings and lessons learned into improvements in defensive capabilities, and partners with engineering and security platform teams to improve visibility and response effectiveness. The role requires responsible use of AI-assisted development and analysis tools in accordance with security, compliance, privacy, and ethical standards. Employees are accountable for applicable risk programs and for following Wells Fargo policies and procedures, fulfilling risk and compliance obligations, escalating and remediating issues, and making sound risk decisions. The company emphasizes proactive monitoring, governance, risk identification, and escalation.

Requirements

7 or more years of engineering experience, or equivalent demonstrated through work experience, training, military experience, education, or a combination of these.
Demonstrated proficiency using AI-assisted development and analysis tools, such as GitHub Copilot and approved code-centric agents.
Strong technical judgment when validating and integrating AI-assisted outputs into solutions.
Ability to account for model limitations, security risks, and operational considerations when using AI.

Nice To Haves

Experience leading incident response during major incidents.
Experience with enterprise incident response and security operations.
Experience investigating incidents with endpoint detection and response (EDR) and extended detection and response (XDR) tools.
Experience with security information and event management (SIEM) tools and large-scale log analysis.
Knowledge and understanding of network and endpoint forensics.
Experience with identity and authentication investigations.
Experience with cloud security investigations.
Knowledge and understanding of malware analysis and attacker tactics, techniques, and procedures.
Knowledge and understanding of the MITRE ATT&CK framework.
Experience with threat intelligence.
Experience with detection engineering and threat hunting.
Experience with scripting or automation for security investigations.
Experience with major incident and ransomware response.
Ability to take ownership of technically ambiguous problems.
Ability to drive investigations from initial escalation through resolution.
Ability to communicate complex technical findings clearly to technical and nontechnical stakeholders.
Ability to influence teams without relying on positional authority.
Ability to mentor less experienced responders.
Ability to turn individual incidents into broader improvements in defensive capability.
Ability to engage effectively with cybersecurity engineering, technology, risk, and external security partners.
Ability to navigate and express confidence to the larger team during high-stress situations.

Responsibilities

Lead technical investigations of complex and high-severity cybersecurity incidents, determining scope, attack path, affected assets, and potential business impact.
Serve as an escalation point for Tier 1 and Tier 2 analysts and provide technical guidance during complex investigations.
Develop containment, eradication, and recovery recommendations and coordinate technical response activities with security, infrastructure, application, and other appropriate teams.
Support major incident and crisis response activities when required.
Correlate endpoint, network, identity, cloud, application, and security telemetry to identify attacker behaviors, persistence mechanisms, lateral movement, and indicators of compromise.
Apply threat intelligence and attacker tactics, techniques, and procedures to active investigations and translate findings into actionable detection and response opportunities.
Identify gaps exposed through incidents and investigations and develop or recommend detection logic, investigative techniques, response procedures, and automation opportunities.
Partner with engineering and security platform teams to improve visibility and response effectiveness and help operationalize cybersecurity technologies and capabilities.
Mentor analysts, facilitate knowledge transfer, develop investigation playbooks and documentation, and create reusable analytical methods.
Participate in tabletop exercises, simulations, after-action reviews, and root cause analysis, translating lessons learned into measurable improvements in processes, technology, telemetry, and response procedures.
Evaluate emerging technologies and techniques that could strengthen incident response capabilities.
Use AI-assisted development and analysis tools to accelerate system design, coding, testing, analysis, and troubleshooting, while validating outputs and accounting for model limitations, security risks, and operational considerations.
Ensure AI use aligns with security, compliance, privacy, and ethical standards.
Follow applicable Wells Fargo policies and procedures, fulfill risk and compliance obligations, and escalate and remediate issues appropriately.