Senior Cyber Defense Engineer

Arrow Electronics•US-CO-Colorado (Remote Employees), CO

1d•$121,300 - $192,693•Remote

About The Position

This role involves leading complex cyber incident investigations across various environments, conducting end-to-end incident response, and performing digital forensics and malware analysis. The engineer will also be responsible for threat hunting, detection engineering, security engineering, and supporting AI and emerging technologies. Additionally, the role includes leadership and mentorship responsibilities, contributing to the maturation of the organization's cyber defense capabilities.

Requirements

5–10+ years of experience in Cyber Security, Incident Response, DFIR, Threat Hunting, Detection Engineering, Security Operations, or related disciplines.
Proven experience leading enterprise-level cyber incident response investigations.
Hands-on experience with digital forensic analysis, evidence collection, malware analysis, and investigative reporting.
Experience working across cloud, hybrid, identity, endpoint, network, and on-premises enterprise environments.
Experience developing detections, automations, playbooks, scripts, queries, or engineering solutions that improve security outcomes.
Strong understanding of Microsoft Entra ID, Active Directory, Azure, Microsoft 365, identity security, and enterprise authentication concepts.
Strong understanding of Windows operating systems, endpoint telemetry, authentication logs, forensic artifacts, and persistence mechanisms.
Strong understanding of Cloud security concepts across Azure, AWS, GCP, SaaS, identity, logging, and monitoring environments.
Strong understanding of Incident response frameworks, cyber kill chain, MITRE ATT&CK, threat intelligence, and threat-informed defense.
Strong understanding of Enterprise security operations including SIEM, EDR, NDR, SOAR, vulnerability data, network security, and email security.
Hands-On Experience With SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, or equivalent technologies.
Hands-On Experience With EDR and XDR platforms such as Microsoft Defender XDR, Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, or equivalent solutions.
Hands-On Experience With Digital forensic tools, forensic imaging, artifact collection, timeline analysis, endpoint investigation, and evidence handling.
Hands-On Experience With Scripting, querying, and automation using PowerShell, Python, Kusto Query Language, SQL, APIs, or equivalent technologies.
Hands-On Experience With Detection engineering, threat hunting, malware triage, alert tuning, dashboards, correlation rules, and response workflows.
Experience performing artifact-based investigations across endpoint, identity, email, cloud, and network data sources.
Knowledge of Windows forensic artifacts, registry analysis, event logs, authentication patterns, persistence techniques, and attacker behaviors.
Ability to analyze attacker activity including phishing, credential theft, lateral movement, privilege escalation, command execution, and data access.
Experience producing forensic timelines, investigative findings, executive summaries, and remediation recommendations.
Ability to operate independently during urgent or high-impact incidents while maintaining accuracy, documentation, and evidence integrity.

Nice To Haves

Bachelor’s degree in Cyber Security, Computer Science, Computer Science, Information Technology, Digital Forensics, or related field; equivalent experience considered.
Experience supporting legal, compliance, HR, fraud, insider risk, or regulatory investigations.
Experience conducting malware analysis, threat hunting, detection engineering, red teaming, penetration testing, or purple team exercises.
Experience experimenting with AI-assisted security tools, copilots, automation workflows, security agents, scripting, or personal lab environments.
Experience in Microsoft-focused enterprise environments, including Microsoft Sentinel, Defender XDR, Entra ID, Azure, Microsoft 365, and KQL.
GIAC Certified Forensic Analyst (GCFA)
GIAC Certified Forensic Examiner (GCFE)
GIAC Certified Incident Handler (GCIH)
GIAC Certified Intrusion Analyst (GCIA)
GIAC Reverse Engineering Malware (GREM)
GIAC Cloud Forensics Responder (GCFR)
GIAC Network Forensic Analyst (GNFA)
GIAC Cyber Threat Intelligence (GCTI)
Offensive Security Certified Professional (OSCP)
Certified Ethical Hacker (CEH)
Certified Information Systems Security Professional (CISSP)
Microsoft Security Operations Analyst
Microsoft Cybersecurity Architect
Other relevant DFIR, Incident Response, Cloud Security, Red Team, Purple Team, or Security Engineering certifications

Responsibilities

Lead complex cyber incident investigations across enterprise, cloud, hybrid, and on-premises environments.
Conduct end-to-end incident response activities including triage, scoping, containment, eradication, recovery, and post-incident reporting.
Investigate network intrusions, account compromise, ransomware, insider risk, fraud-related incidents, unauthorized access, and advanced threat actor activity.
Preserve evidence and maintain chain-of-custody procedures for forensic, legal, compliance, and regulatory investigations.
Produce clear investigative findings, root cause analysis, executive summaries, and remediation recommendations.
Perform DFIR activities across Windows, cloud, identity, endpoint, network, and application environments.
Conduct dead-box forensic examinations, artifact analysis, timeline analysis, and evidence collection.
Collect, analyze, and interpret host, network, cloud, email, identity, and application artifacts.
Analyze suspicious files, malware behavior, persistence mechanisms, attacker tooling, and indicators of compromise.
Support sensitive investigations involving Legal, HR, Compliance, Insider Risk, and business stakeholders.
Conduct proactive threat hunting to identify adversary behaviors, emerging threats, and control gaps.
Develop, tune, and improve SIEM detections, correlation rules, KQL queries, alerts, dashboards, and response workflows.
Apply MITRE ATT&CK, threat intelligence, incident lessons learned, and attacker TTPs to improve detection coverage.
Partner with SOC, Threat Intelligence, Engineering, and Platform teams to validate visibility and improve response outcomes.
Support continuous improvement of threat detection, alert quality, incident workflows, and security monitoring use cases.
Support the engineering, administration, and optimization of cyber security tools and platforms.
Assist with log source onboarding, data normalization, telemetry validation, and use-case development.
Partner with Infrastructure, Cloud, Identity, Application, and Security Operations teams to improve visibility and response capability.
Build scripts, queries, automation, dashboards, and technical workflows that improve investigation speed and quality.
Help mature enterprise security capabilities across SIEM, EDR, NDR, SOAR, cloud security, identity security, and forensic tooling.
Use AI-assisted tools, copilots, automation, and scripting to improve investigation efficiency, reporting, and analysis.
Demonstrate curiosity and willingness to learn emerging AI, automation, and agent-assisted security operations capabilities.
Contribute to team initiatives involving AI-assisted workflows, personal security agents, team-developed agents, and operational automation.
Show evidence of hands-on experimentation through lab work, scripting, automation, prompt testing, AI tools, or practical tinkering.
Understand the security considerations of AI usage, including data protection, responsible use, prompt safety, and operational governance.
Apply an offensive security mindset during investigations to better understand attacker behavior, objectives, and tradecraft.
Support threat emulation and purple team activities that validate detections, controls, and response procedures.
Use knowledge of penetration testing, red teaming, adversary simulation, or ethical hacking to strengthen blue team defenses.
Assist with threat actor tracking, attack path analysis, lateral movement analysis, persistence review, and detection validation.
Serve as a senior technical lead during significant cyber security investigations and incident response efforts.
Mentor SOC Leads, Security Analysts, Incident Responders, and Security Engineers on investigative and forensic methodologies.
Contribute to playbooks, runbooks, investigation standards, threat hunting procedures, and operational documentation.
Help mature the organization’s DFIR, Incident Response, Detection Engineering, Threat Hunting, and Security Automation capabilities.
Communicate effectively with technical teams, leadership, Legal, HR, Compliance, and business stakeholders.