Senior Incident Response Engineer at AlphaSense

, , United States -

Full Time

Start Date

Immediate

Expiry Date

23 Apr, 26

Salary

161000.0

Posted On

23 Jan, 26

Experience

10 year(s) or above

Remote Job

Yes

Telecommute

Yes

Sponsor Visa

Skills

Detection Engineering, Incident Response, Automation, Threat Hunting, Security Operations, SIEM, EDR, Cloud Platforms, Python, YARA-L, SIGMA, MITRE ATT&CK, SOAR, Data Analysis, Anomaly Detection, Security Frameworks

Industry

Software Development

Description

ABOUT ALPHASENSE: The world’s most sophisticated companies rely on AlphaSense to remove uncertainty from decision-making. With market intelligence and search built on proven AI, AlphaSense delivers insights that matter from content you can trust. Our universe of public and private content includes equity research, company filings, event transcripts, expert calls, news, trade journals, and clients’ own research content. The acquisition of Tegus by AlphaSense in 2024 advances our shared mission to empower professionals to make smarter decisions through AI-driven market intelligence. Together, AlphaSense and Tegus will accelerate growth, innovation, and content expansion, with complementary product and content capabilities that enable users to unearth even more comprehensive insights from thousands of content sets. Our platform is trusted by over 6,000 enterprise customers, including a majority of the S&P 500. Founded in 2011, AlphaSense is headquartered in New York City with more than 2,000 employees across the globe and offices in the U.S., U.K., Finland, India, Singapore, Canada, and Ireland. Come join us! Location: Remote within USA ABOUT THE ROLE The Senior Detection, Automation, and Incident Response Engineer is a critical technical role responsible for driving the organization's defensive security capabilities across detection engineering, security orchestration, automation, and response (SOAR), and co-leading the organization's threat hunting program. This role is crucial for integrating new threat intelligence into high-fidelity detections and automating incident response processes to maximize team efficiency and response speed. You'll work directly with the Director of Security Monitoring, Detection and Response and collaborate closely with the SOC Manager to co-lead threat hunting initiatives, while partnering with cross-functional security teams to build and scale our security operations capabilities. ABOUT OUR SECURITY TEAM You'll be joining a fast-paced security organization that emphasizes automation, engineering-driven approaches, and systematic problem-solving. Our team operates at the intersection of security operations, detection engineering, incident response, and infrastructure security. We value practical solutions, measurable outcomes, and continuous improvement. What You’ll Do: 1. DETECTION ENGINEERING & PLATFORM LEADERSHIP (40%) * Design, implement, and maintain advanced detection rules and correlation logic across SIEM , EDR, and Cloud platforms (AWS, GCP) * Lead detection strategy and architecture aligned with the Detection Quality frameworks * Write high-fidelity detection rules using languages like SIGMA and YARA-L * Conduct deep log source analysis, perform threat modeling, adversary emulation, and maintain MITRE ATT&CK mapping coverage * Conduct detection gap analysis to identify coverage opportunities across the kill chain * Create and maintain detection playbooks, runbooks, and comprehensive documentation * Perform detection quality assessments and continuous improvement initiatives 2. SECURITY AUTOMATION (SOAR) & RESPONSE LEADERSHIP (40%) * Develop complex automated response playbooks for multi-stage incidents spanning multiple security tools * Integrate security tools via APIs (SIEM, EDR, MDM, CASB, ITSM, threat intelligence platforms) * Create automated enrichment pipelines incorporating threat intelligence, asset context, and user behavior analytics * Develop automated containment actions (account disable, host isolation, firewall rule updates) * Measure and report automation ROI, tracking metrics like time saved and incident handling efficiency * Handle Incident Response processes and procedures as needed 3. THREAT HUNTING CO-LEADERSHIP & EXECUTION (20%) * Co-lead the organization's threat hunting program with the SOC Manager, defining strategy, methodology, and campaign planning * Execute proactive threat hunting campaigns by conducting hunt queries across SIEM and EDR platforms * Analyze large datasets to identify anomalous behavior patterns including user behavior, process execution, network traffic, and cloud activity * Develop hunting automation and tooling using custom Python scripts, Jupyter Notebooks, Osquery, and Velociraptor * Collaborate with threat intelligence sources to incorporate latest TTPs into hunting campaigns WHAT WE ARE LOOKING FOR: * 7+ years in security operations with 3+ years in detection engineering, including deep expertise in creating high-fidelity rules (SIGMA, YARA-L, KQL, SPL). * Proven track record of building detection strategies across SIEM, EDR, and Cloud platforms, grounded in the MITRE ATT&CK framework. * Expert knowledge of SOAR platforms (e.g., Tines, Splunk SOAR, Cortex XSOAR), architecture, and complex playbook development. * Proven experience designing and implementing SOAR platform architecture from concept to production. * Advanced scripting and automation development skills in Python (required) for API integrations and security tool orchestration. * Strong background in threat hunting methodology, hypothesis development, and campaign execution, with experience leading or co-leading hunting programs. * Proficiency with data analysis, anomaly detection, and hands-on experience with hunting tools like Jupyter Notebooks, Osquery, and Velociraptor. * Deep understanding of attack techniques, lateral movement, persistence mechanisms, and post-exploitation TTPs across Windows, Linux, and macOS. * Familiarity with security frameworks including MITRE ATT&CK, PICERL, NIST CSF, and Detection Maturity Models, and incident response best practices. * Proven ability to lead technical initiatives, mentor team members, and communicate complex technical concepts to diverse audiences. PREFERRED QUALIFICATIONS * Experience with YARA-L. * Deep familiarity with Detection Frameworks and detection engineering quality frameworks. * Proven track record implementing SOAR platforms from architecture through operationalization, with experience evaluating multiple platforms. * Advanced knowledge of CrowdStrike Falcon platform including custom IOA rules. * Background in purple team activities, adversary emulation, or red teaming. * Experience with CI/CD practices for detection-as-code and automation-as-code. * Contributions to open-source security projects or security certifications (GCDA, GCIH, GCIA, GCFA, OSCP, or equivalent). * Knowledge of security data lakes (Snowflake, BigQuery) and experience with threat intelligence platforms (TIP). * Published research, blog posts, or conference presentations on detection engineering, automation, or threat hunting topics. BEHAVIOR: * Strategic Thinker: You design solutions that scale, anticipate future needs, and align with organizational security strategy * Builder & Architect: You design and build complex systems from the ground up, with focus on maintainability and scalability * Quality & Precision Focused: You care deeply about detection accuracy, automation reliability, and operational excellence * Proactive Hunter: You don't wait for alerts—you actively seek threats and continuously question assumptions * Data-Driven: You use metrics and data analysis to drive decisions, measure impact, and communicate value WHY JOIN ALPHASENSE SECURITY * High-Impact Leadership Role: Own critical security capabilities (detection, automation, hunting) with direct organizational impact * Greenfield Opportunities: Architect and build SOAR platform from the ground up and lead major SIEM migration efforts * Technical Depth: Solve complex problems at scale with Modern security stack * Scale & Complexity: Protect a critical platform serving enterprise customers with sophisticated threats * Autonomy & Influence: Shape security architecture decisions, tool evaluations, and team direction * Growing Team: Join a growing team with clear structure, specialized roles, and growth trajectory * Balance & Variety: Split time between strategic architecture (detection, SOAR) and hands-on execution (hunting, investigation) * Innovation Culture: Implement detection-as-code, automation-as-code, and data-driven security practices Important notice: We are an AI-driven company and actively use AI tools in our day-to-day work. However, the use of AI tools during the interview process is not permitted. Interviews are designed to assess your individual skills and thinking. If we determine that a candidate is using AI assistance to answer interview questions, this may result in disqualification from the hiring process. For base compensation, we set standard ranges for all roles based on function and level benchmarked against similar stage growth companies and internal comparables. In order to be compliant with local legislation, as well as to provide greater transparency to candidates, we share salary ranges on all job postings regardless of desired hiring location. Final offer amounts are determined by multiple factors including candidate experience/expertise and may vary from the amounts listed below. You may also be offered a performance-based bonus, equity, and a generous benefits program. Base Compensation Range $128,000—$161,000 USD AlphaSense is an equal-opportunity employer. We are committed to a work environment that supports, inspires, and respects all individuals. All employees share in the responsibility for fulfilling AlphaSense’s commitment to equal employment opportunity. AlphaSense does not discriminate against any employee or applicant on the basis of race, color, sex (including pregnancy), national origin, age, religion, marital status, sexual orientation, gender identity, gender expression, military or veteran status, disability, or any other non-merit factor. This policy applies to every aspect of employment at AlphaSense, including recruitment, hiring, training, advancement, and termination. In addition, it is the policy of AlphaSense to provide reasonable accommodation to qualified employees who have protected disabilities to the extent required by applicable laws, regulations, and ordinances where a particular employee works. Recruiting Scams and Fraud We at AlphaSense have been made aware of fraudulent job postings and individuals impersonating AlphaSense recruiters. These scams may involve fake job offers, requests for sensitive personal information, or demands for payment. Please note: * AlphaSense never asks candidates to pay for job applications, equipment, or training. * All official communications will come from an @alpha-sense.com [http://alpha-sense.com/] email address. * If you’re unsure about a job posting or recruiter, verify it on our Careers page [https://www.alpha-sense.com/careers/]. If you believe you’ve been targeted by a scam or have any doubts regarding the authenticity of any job listing purportedly from or on behalf of AlphaSense please contact us. Your security and trust matter to us.

Responsibilities

The Staff Incident Response Engineer will drive the organization's defensive security capabilities, focusing on detection engineering, automation, and incident response. This role includes co-leading the threat hunting program and integrating new threat intelligence into high-fidelity detections.