SOC/Incident Report Engineer
About The Position
Are you excited about detecting and resolving cybersecurity threats and incidents? Do you find it a challenge to help an organization reduce threats and enhance their security? Does working with teams to develop strategies to improve detection capabilities? Then you may be interested in our SOC/Incident Report Engineer position. This role is perfect for the individual looking to play a crucial role in Benesch's security initiatives. The SOC/Incident Response Engineer is responsible for detecting, investigating, and responding to cybersecurity incidents across the Firm. This role combines threat detection, digital forensics, malware triage, and cloud security expertise to protect organizational assets, reduce risk, and strengthen security posture. The SOC/Incident Response Engineer will operate within a 24/7 security operations environment, collaborating with cross-functional teams to analyze threats, develop response strategies, and improve detection capabilities.
Requirements
- The SOC/Incident Response (IR) Engineer should have 3–7 years of experience in a Security Operations Center (SOC), incident response, digital forensics, or a closely related cybersecurity discipline.
- A strong technical foundation in networking, operating system internals across Windows, Linux, and macOS, identity systems, and modern cloud architectures is essential.
- The role requires hands-on experience with leading security technologies, including SIEM platforms such as Microsoft Sentinel or Splunk, endpoint detection and response (EDR) and antivirus tools like Microsoft Defender for Endpoint or CrowdStrike, and forensic toolsets including Velociraptor, Autopsy, FTK, and KAPE.
- Experience utilizing malware analysis sandboxes and static analysis frameworks, as well as cloud security tools such as Azure Defender, AWS GuardDuty, and Google Cloud Security Command Center (SCC), is also required.
- Familiarity with scripting and automation languages, particularly Python, PowerShell, and KQL, is highly desirable.
Nice To Haves
- Preferred certifications include GIAC GCIA, GCFA, GCIH, or GNFA; AWS Security Specialty or Google Professional Cloud Security Engineer; and industry-recognized credentials such as CISSP, CEH, or CySA+ (or their equivalents).
Responsibilities
- Security Monitoring & Threat Detection
- Incident Response & Triage
- Digital Forensics & Malware Analysis
- Cloud Security & IR
- Security Tooling & Automation
- Threat Intelligence & Research
- Collaboration, Compliance & Reporting
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
Education Level
No Education Listed
Number of Employees
101-250 employees
