Principal Security Engineer, Incident Response

Advance Auto Parts•Raleigh, NC

2d•Hybrid

About The Position

The Principal Security Engineer, Incident Response is a senior technical cybersecurity role leading the investigation, containment, eradication, and recovery of security incidents across Advance Auto Parts’ enterprise environment. Reporting to the Sr. Manager, Cybersecurity Incident Response, the role is a technical lead and escalation point within the Incident Response program, ensuring incidents are rapidly triaged, thoroughly investigated, and fully remediated while minimizing risk to business operations, customers, team members, and the company’s reputation. The role partners across Cybersecurity, Technology, Legal, Privacy, Risk Management, Store Operations, and Supply Chain Operations to resolve complex security events and strengthen resilience against threats such as ransomware, identity-based attacks, cloud compromises, insider threats, and third-party breaches. This hybrid position is based at the corporate headquarters in Raleigh, North Carolina, with four days in the office and one day remote.

Requirements

At least 6 years of cybersecurity experience, including at least 3 years focused on incident response, digital forensics, or threat hunting.
Proven experience leading investigations of ransomware, business email compromise, cloud attacks, and identity-based attacks.
Hands-on expertise with security technologies, including SIEM, SOAR, EDR, cloud security tools, and network and forensic analysis tools.
Working knowledge of Windows, Linux, Active Directory/Entra ID, and at least one major cloud platform: AWS, Azure, or GCP.
Experience with cybersecurity frameworks, including NIST SP 800-61, NIST CSF, and MITRE ATT&CK.
Scripting ability in Python, PowerShell, or a similar language to support investigations and automation.
Excellent written and verbal communication skills, including the ability to explain technical findings to non-technical audiences.

Nice To Haves

Certifications such as GCIH, GCFA, GCFE, GNFA, GREM, or CISSP.
Experience in large-scale, complex organizations, retail, or highly regulated industries.
Expertise in cybersecurity automation and analytics.

Responsibilities

Lead technical response to high-severity cybersecurity incidents from detection through closure.
Serve as technical lead and deputy to the Incident Commander during major cybersecurity events.
Investigate and respond to ransomware, malware outbreaks, business email compromise, credential theft, cloud compromise, insider threats, and third-party breaches.
Perform host, network, memory, log, and cloud forensic analysis to determine root cause, scope, and impact.
Coordinate containment, eradication, and recovery actions with Technology and business teams.
Preserve evidence and maintain chain of custody for legal, regulatory, privacy, and cyber insurance requirements.
Act as the escalation point for junior incident responders handling complex or ambiguous security events.
Produce incident documentation, technical findings, and status updates for leadership.
Conduct proactive, hypothesis-driven threat hunts to identify advanced attacker activity.
Translate incident findings into new or improved detections aligned to MITRE ATT&CK.
Partner with Engineering teams to tune monitoring technologies and improve signal-to-noise ratios.
Use threat intelligence to enrich investigations and anticipate threat actor tactics, techniques, and procedures targeting the retail industry.
Identify opportunities to automate triage, enrichment, and response actions.
Develop, maintain, and test incident response playbooks.
Support tabletop exercises, ransomware preparedness exercises, and cyber crisis simulations.
Lead post-incident reviews and track corrective actions through completion.
Contribute incident data to operational metrics, including Mean Time to Detect and Mean Time to Respond.
Mentor junior incident responders through case reviews and hands-on coaching.
Share knowledge through runbooks, training sessions, and lessons learned.
Coordinate with external incident response retainers, forensic vendors, and law enforcement as directed.
Model accountability, resilience, and continuous improvement.