FREE ACCESS
5,000–10,000 jobs/day
See all jobs on Scoutfield
Search thousands of fresh jobs every day.
Discover
- Fresh listings
- Fast filters
- No subscription required
Create a free account and start exploring right away.
Principal Cybersecurity Incident Response Engineer
Wells Fargo. Lead technical investigations of complex and high-severity cybersecurity incidents .
Core Competencies
Role fitCore Competencies
Use this summary to align your resume positioning with the role.
Demonstrates extensive experience in leading complex cybersecurity incident investigations, utilizing advanced analysis techniques and threat intelligence to drive effective incident response and recovery. Proficient in developing detection logic and operationalizing new technologies while mentoring and guiding less experienced analysts.
Highest-signal resume keywords
Incident Response LeadershipEDR And XDR Tools ExperienceSIEM Tools And Log AnalysisThreat Intelligence ApplicationMITRE ATT&CK Framework Knowledge
ATS Keywords
Tailor your resumeApplicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard Skills
Cybersecurity Incident InvestigationNetwork And Endpoint ForensicsMalware AnalysisDetection EngineeringScripting Or Automation For SecurityCloud Security InvestigationsIdentity And Authentication InvestigationsAdvanced Analysis TechniquesAI-Assisted DevelopmentThreat Hunting
Soft Skills
Technical CommunicationMentoringInfluencing Without AuthorityOwnership Of Ambiguous ProblemsHigh Stress Navigation
Tools & Technologies
EDR ToolsXDR ToolsSIEM ToolsAI-Assisted Development ToolsSecurity Telemetry
Industry Keywords
CybersecurityIncident ResponseThreat IntelligenceRansomware ResponseCompliance And Ethical Standards
Tech Stack
Tools & technologiesCloudCyber Security
About the role
Key responsibilities & impact- Lead technical investigations of complex and high-severity cybersecurity incidents
- Determine incident scope, attack path, affected assets, and potential business impact
- Serve as a technical escalation point for Tier 1 and Tier 2 analysts
- Provide technical guidance during complex investigations
- Develop containment, eradication, and recovery recommendations
- Coordinate technical response activities with security, infrastructure, application, and other teams
- Support major incident and crisis response activities
- Correlate endpoint, network, identity, cloud, application, and security telemetry
- Perform advanced analysis to identify attacker behaviors, persistence mechanisms, lateral movement, and indicators of compromise
- Apply threat intelligence and attacker tactics, techniques, and procedures to active investigations
- Translate findings into actionable detection and response opportunities
- Identify incident-related gaps and develop or recommend detection logic, investigative techniques, response procedures, and automation
- Partner with engineering and security platform teams to improve visibility and response effectiveness
- Help operationalize new cybersecurity technologies and capabilities
- Mentor analysts and facilitate knowledge transfer
- Develop investigation playbooks, documentation, and reusable analytical methods
- Provide technical leadership without formal people-management responsibilities
- Participate in tabletop exercises, simulations, after-action reviews, and root-cause analysis
- Translate lessons learned into measurable improvements in processes, technology, telemetry, and response procedures
- Evaluate emerging technologies and techniques to strengthen incident response
- Leverage AI to accelerate system design, coding, testing, analysis, and troubleshooting
- Validate and integrate AI-assisted outputs into solutions
- Apply AI responsibly while meeting security, compliance, privacy, and ethical standards
Requirements
What you’ll need- 7+ years of Engineering experience, or equivalent demonstrated through one or a combination of work experience, training, military experience, or education
- Experience leading Incident Response during major incidents
- Experience with enterprise incident response and security operations
- Experience investigating incidents with EDR and XDR tools
- Experience with SIEM tools and large-scale log analysis
- Knowledge and understanding of network and endpoint forensics
- Experience with identity and authentication investigations
- Experience with cloud security investigations
- Knowledge and understanding of malware analysis and attacker tactics, techniques, and procedures
- Knowledge and understanding of the MITRE ATT&CK framework
- Experience with threat intelligence
- Experience with detection engineering and threat hunting
- Experience with scripting or automation for security investigations
- Experience with major incident and ransomware response
- Ability to take ownership of technically ambiguous problems
- Ability to drive investigations from initial escalation through resolution
- Ability to communicate complex technical findings clearly to technical and nontechnical stakeholders
- Ability to influence teams without relying on positional authority
- Ability to mentor less experienced responders
- Ability to turn individual incidents into broader improvements in defensive capability
- Ability to engage effectively with cybersecurity engineering, technology, risk, and external security partners
- Ability to navigate and express confidence to the larger team during high stress situations
- Proficiency in AI-assisted development and analysis tools, such as GitHub Copilot and approved code-centric agents
- Ability to account for AI model limitations, security risks, and operational considerations
- Ability to apply AI responsibly in development and production environments
- Ability to align AI usage with security, compliance, privacy, and ethical standards
Benefits
Comp & perks- Equal opportunity employment
- Medical accommodation available during the application or interview process
- Drug-free workplace
- Risk and compliance-focused workplace culture