Principal Incident Response Engineer
About The Position
The Principal Incident Response Engineer (DFIR) leads complex cyber investigations, strengthens RGA's enterprise resilience, and guides security teams through critical incidents. The role combines hands-on digital forensics and incident response expertise with strategic advisory work, stakeholder engagement, and security program leadership across global environments. It delivers cross-organizational projects and supports global Security Operations through operations, development, and engineering. The position provides technical leadership during investigations, influences strategic security decisions, contributes to capability development, and serves as a trusted advisor for cybersecurity risk management and response readiness. The engineer leads incidents from detection through recovery, directs investigations across endpoint, network, cloud, identity, and SaaS environments, and supports a 24/7 on-call rotation.
Requirements
- Master’s degree in Arts/Sciences (MA/MS) or equivalent experience.
- At least 8 years in incident response, DFIR, security operations, consulting, or related cybersecurity disciplines.
- Ability to lead complex incidents and evolve strategies based on new information.
- Experience leading major cyber incidents involving ransomware, business email compromise, insider threats, cloud compromise, supply chain attacks, or advanced persistent threats.
- Strong digital forensics capability using industry-standard forensic and triage tools.
- Experience with Splunk, Microsoft Defender, CrowdStrike Falcon, ServiceNow SIR, and cloud security technologies.
- Knowledge of network protocols, detection engineering, log analytics, and threat hunting methodologies.
- Excellent verbal and written communication skills for technical and executive audiences.
- Demonstrated ability to manage multiple priorities in a global enterprise environment.
- Experience with forensic tools such as FTK, EnCase, X-Ways, Magnet Axiom, or SIFT.
- Advanced analytical skills and ability to investigate network, host, cloud, and identity platforms.
- Ability to collaborate effectively with partner teams.
- Ability to adapt quickly to new methods and work under tight deadlines and stressful conditions.
- Advanced investigative, analytical, and problem-solving skills.
- Advanced ability to set goals and handle multiple tasks, clients, and projects simultaneously.
- Ability to balance priorities, deadlines, and deliverables.
- Advanced ability to translate business needs and problems into viable, accepted solutions.
- Technical knowledge of Windows, Mac, and Linux internals; PowerShell, Python, JavaScript, or TypeScript scripting; forensic tools; AWS; Microsoft 365; Microsoft domain environments; IAM/AAA technologies and architectures including Active Directory, Okta, OpenID, SAML, OAuth, and JWT; physical and virtual networking technologies, architecture, and defensive technologies; Splunk SIEM; CrowdStrike and Microsoft Defender EDR; threat intelligence platforms and feeds; email architecture and security; and DNS architecture and security.
Nice To Haves
- 10 or more years of relevant experience.
- Industry-level contributions such as conferences, publications, tooling, or seminars.
- Professional industry certification.
Responsibilities
- Lead enterprise incident response and cyber crisis engagements from detection through recovery.
- Direct host, network, cloud, identity, and SaaS investigations across Windows, Linux, macOS, Microsoft 365, AWS, Azure, and hybrid environments.
- Perform advanced threat hunting and compromise assessments using SIEM, EDR, forensic, and threat intelligence platforms.
- Develop containment, eradication, and remediation strategies aligned to business risk.
- Produce executive briefings, technical reports, board-ready updates, and post-incident reviews.
- Partner with legal, compliance, privacy, audit, and external stakeholders when required.
- Drive adoption of AI-assisted workflows to improve investigation speed, reporting quality, and operational efficiency.
- Support the 24/7 on-call rotation.
- Provide technical leadership during investigations, influence strategic security decisions, and contribute to capability development.
Benefits
- Annual bonus plan.
- Some positions are eligible for participation in a long-term equity incentive plan.
- Health, retirement, and other employee benefits.
- Opportunity to gain knowledge and experience from diverse colleagues around the world.
- Respectful, welcoming environment that fosters individuality and encourages pioneering thought.
- Career potential and global opportunities.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
