Information Security Engineer - Principal

Position Summary:

We are seeking an experienced Principal Security Operations Lead to join the North America Information Security team, reporting directly to the Director of Security Operations. This is a hands-on technical role focused on incident response, threat intelligence, and forensic investigations across cloud and legacy environments.

The successful candidate will help support a unified enterprise security operations model, including the continued implementation of SIEM and detection tools across environments, advanced threat intelligence, and automated response processes. The role requires strong Microsoft Azure and Microsoft 365 security experience, multi-layer investigations, phishing response, clear communication, and the ability to work across Security Engineering, Security Operations, GRC, Infrastructure, Cloud, DevOps, application, and business teams.

This role is expected to act as the key contact for technical investigations, drive remediation, produce clear documentation and evidence, and provide quality review and escalation support for repeatable work performed by offshore or managed-service partners.

What You Will Do:

Threat Intelligence and Adversary Analysis

• Lead the collection, analysis, and operationalization of cyber threat intelligence from internal telemetry, commercial intelligence providers, open-source intelligence (OSINT), and industry sharing groups.

• Analyze adversary tactics, techniques, and procedures (TTPs) using frameworks such as MITRE ATT&CK and translate intelligence into actionable detections, monitoring requirements, investigations, and security control improvements.

• Develop intelligence reports, threat briefs, and executive summaries that communicate emerging threats, risk trends, adversary activity, and potential business impacts.

• Track industry-specific threats affecting insurance, financial services, healthcare, cloud platforms, and software supply chains.

• Partner with Security Engineering and Security Architecture teams to incorporate threat intelligence into detection logic, control design, policy updates, and incident response processes.

Security Monitoring and Incident Investigation

• Lead advanced investigations involving suspicious activity, account compromise, insider threats, ransomware, malware infections, cloud attacks, phishing campaigns, business email compromise, data exfiltration, and unauthorized access attempts.

• Perform deep analysis of security alerts generated by SIEM, XDR, EDR, email security, identity platforms, cloud security

• solutions, and network security tools.

• Correlate logs, events, endpoint telemetry, cloud activity, authentication records, and threat intelligence to determine attack

• scope, impact, and root cause.

• Serve as an escalation point for complex investigations requiring advanced analytical skills, cross platform analysis, or forensic validation.

Digital Forensics and Evidence Preservation

• Conduct forensic investigations involving endpoints, servers, Microsoft 365, Azure, identity platforms, email systems, cloud workloads, and hybrid environments.
• Acquire, preserve, analyze, and document digital evidence while maintaining chain-of custody requirements and evidentiary integrity.
• Perform memory analysis, artifact collection, timeline reconstruction, log validation, malware triage, and root-cause investigations.
• Develop forensic findings reports that clearly document attack timelines, affected assets, responsible threat activity, business impact, and recommended remediation actions.
• Support legal, compliance, audit, and regulatory response activities requiring technical investigative evidence and forensic documentation.

Threat Hunting and Detection Engineering

• Design and execute proactive threat-hunting activities to identify malicious activity that may evade traditional detection methods.
• Hypothesis driven hunting across Azure, Microsoft 365, Sentinel, Microsoft XDR, Defender for Endpoint, Entra ID, network telemetry, and cloud application logs.
• Develop and improve advanced detection logic, correlation rules, behavioral analytics, watchlists, and hunting queries based onemerging threats and intelligence findings.
• Identify detection gaps and recommend new monitoring capabilities to improve visibility across cloud, endpoint, identity, and network environments.

Incident Response and Cyber Crisis Support

• Serve as a lead technical responder during cybersecurity incidents, coordinating containment, eradication, recovery, and post-incident analysis activities.

• Guide incident response efforts during ransomware events, credential compromise investigations, data breaches, insider threat cases, cloud security incidents, and advanced persistent threat (APT) activity.

• Facilitate technical war rooms and provide timely status updates to leadership, technology teams, legal stakeholders, and

• executive management.

• Ensure incidents are documented thoroughly with clear investigative findings, response actions, lessons learned, and

• remediation recommendations.

• Participate in incident response exercises, tabletop simulations, and cyber resilience testing to improve organizational

• readiness.

Security Operations Platform Optimization

• Support and continuously improve Microsoft Sentinel, Microsoft XDR, Defender for Endpoint, Defender for Cloud, Entra ID,

• Crowdstrike, and related detection and investigation technologies.

• Create dashboards, automated workflows, enrichment processes, and case management integrations that improve investigation speed and analyst effectiveness.

• Tune detections, reduce false positives, standardize triage processes, and help mature security operations capabilities across

• the enterprise.

• Develop metrics and reporting that measure detection performance, investigation quality, containment effectiveness, Mean Time to Acknowledge (MTTA), and Mean Time to Respond (MTTR).

Senior Technical Expertise and Security Operations Maturity

• Act as a senior analyst and subject matter expert for threat intelligence, forensic investigations, incident response, and threat hunting activities.
• Provide quality review, mentoring, and escalation support for analysts, offshore resources, managed security service providers, and security operations partners.
• Develop investigation playbooks, forensic procedures, threat-hunting methodologies, standard operating procedures, and analyst training materials.
• Maintain professional documentation including incident reports, forensic reports, threat profiles, attack-path analysis, runbooks, diagrams, and executive briefings.
• Stay current on emerging threats, attack techniques, cloud security risks, adversary campaigns, and cybersecurity best practices to continuously strengthen organizational defense capabilities.

What You Will Bring:

• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Digital Forensics, Information Assurance, or a related discipline; equivalent professional experience may be considered.
• Minimum 10 years of progressive experience in Security Operations, Threat Intelligence, Incident Response, Threat Hunting, Digital Forensics, or Cyber Defense roles within enterprise environments.
• Demonstrated experience conducting complex investigations involving ransomware, business email compromise (BEC), insider threats, account compromise, malware infections, cloud security incidents, advanced persistent threats (APT), and data exfiltration events.
• Advanced knowledge of cyber threat intelligence methodologies, including the collection, enrichment, analysis, and operationalization of intelligence from commercial providers, industry sharing groups, open-source intelligence (OSINT), and internal telemetry sources.
• Strong understanding of adversary tactics, techniques, and procedures (TTPs) and the ability to leverage frameworks such MITRE ATT&CK, Cyber Kill Chain, Diamon Model, and ATT&CK Navigator to support investigations, threat hunting, and detection engineering activities.
• Proven experience converting threat intelligence into actionable security outcomes, including new detections, hunting hypotheses, correlation rules, watchlists, automated response actions, and security control enhancements.
• Deep experience performing digital forensic investigations across endpoints, servers, Microsoft 365, Azure, cloud workloads, email platforms, identity systems, and hybrid environments.
• Hands-on expertise in forensic evidence acquisition, preservation, chain-of custody management, timeline construction, artifact analysis, memory analysis, malware triage, and root-cause determination.
• Strong analytical skills with experience correlating endpoint telemetry, cloud logs, authentication records, network activity, SIEM data,
• threat intelligence, and forensic artifacts to identify malicious activity and determine business impact.
• Extensive experience conducting proactive threat hunting across Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, CrowdStrike, Microsoft 365, Entra ID, Azure, endpoint telemetry, cloud platforms, network security data sources.
• Expertise developing advanced detection content, including SIEM analytics rules, behavioral detections, KQL hunting queries, automation workflows, enrichment logic, and incident investigation playbooks.
• Hands-on experience with Microsoft security technologies including Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, Defender for Cloud, Defender for Identity, Microsoft Purview, Entra ID, and related security monitoring platforms.
• Strong understanding of log analysis, packet analysis, endpoint investigations, cloud security monitoring, attack-path analysis, and forensic validation techniques.
• Experience leading technical response activities during cybersecurity incidents, including containment, eradication, recovery, evidence preservation, executive communications, and post-incident reviews.
• Experience producing high-quality forensic reports, threat intelligence assessments, attack narratives, executive briefings, and technical documentation suitable for legal, audit, compliance, and leadership audiences.
• Knowledge of regulatory and compliance requirements impacting security investigations, including evidence handling, audit readiness, data protection obligations, breach response, and regulatory reporting requirements.
• Strong understanding of security frameworks and best practices including NIST Cybersecurity Framework, NIST 800-61, NIST800-86, NIST 800-53, MITRE ATT&CK, CIS Controls, ISO 27001, and ISO 27035.
• Excellent written and verbal communic