Senior Incident Response Engineer

The role

You will lead detection and remediation efforts as the primary technical liaison to the MSSP. You will conduct forensic investigations, execute threat hunts, and manage incident response playbooks and documentation.

What you will do

• Serve as primary internal SIEM engineer and liaison to MSSP.
• Lead technical response to validated security incidents.
• Conduct deep-dive forensic investigations including memory analysis and disk imaging.
• Execute proactive threat hunts using SIEM data.
• Develop and validate custom detection rules mapped to MITRE ATT&CK.
• Design and maintain incident response playbooks and SOAR workflows.
• Design log collection requirements and facilitate external compliance audits.
• Manage endpoint and system detection policies and perform live response.
• Identify and consume cyber threat intelligence feeds.
• Own IR documentation architecture including procedures and runbooks.

Required qualifications

• 5+ years in Incident Response or Security Operations (SOC).
• Experience managing MSSP relationships, alert triage, and SLA performance.
• Experience investigating security incidents including malware, phishing, ransomware, and insider threats.
• Deep understanding of OS internals (Windows/Mac/Linux).
• Knowledge of network protocols.
• Proficiency in scripting (Python, PowerShell, Bash).
• Working knowledge of SIEM platforms (Google SecOps/Chronicle, Splunk, Microsoft Sentinel).
• Proficiency in query languages (YARA-L/GoogleSQL, SPL, KQL).
• Hands-on experience with SOAR platforms (Google SecOps/Chronicle, Palo Alto Cortex XSOAR, Splunk Phantom SOAR).
• Knowledge of Cyber Threat Intelligence standards and User Behavior Analytics (UEBA).
• Strong technical writing skills for security documentation.
• Experience designing, leading, and facilitating tabletop exercises, purple team engagements, or incident simulations.

Nice to have

• Advanced malware analysis skills (static/dynamic) using IDA Pro, Ghidra, or Cuckoo Sandbox.
• Familiarity administering email security platforms (Material Security, ProofPoint, Check Point Harmony) and conducting phishing campaigns.
• Strong understanding of NIST SP 800-171 and CMMC Level 2 requirements.
• Familiarity with aerospace and startup environments.

About the company

Archer is a leader in the next-gen aerospace sector building an end-to-end advanced air mobility platform. The company delivers air taxis, unmanned aircraft systems, and aviation-related physical artificial intelligence solutions.