Lead/ Senior Security Engineer- Incident Response - CSIRT - Cloud Security

FICO is a global analytics software company that helps businesses make better decisions. The Senior/Lead Incident Response Engineer will lead defensive security operations by owning incident detection, containment, recovery, preparedness, and cross-functional tabletop exercises. The role also supports digital forensics, cloud and AI security programs, and the use of security tooling, AI, and automation in incident response workflows.

Responsibilities:

• Design and facilitate incident response tabletop exercises across security, IT, engineering, legal, and business teams, testing preparedness and surfacing gaps
• Own the full incident lifecycle: detection, triage, containment, eradication, recovery, and post-incident review
• Build and maintain IR plans, playbooks, and runbooks for consistent, repeatable response
• Partner with threat intelligence, SOC, and engineering to turn IR and exercise findings into stronger detection and controls
• Communicate clearly with stakeholders at all levels, during incidents and in reporting
• Support digital forensics investigations, apply the PICERL and NIST frameworks, and lead IR activities in cloud environments using SIEM, CSPM, and other cloud security tooling
• Bring an IR perspective to FICO’s cloud and AI security programs and use AI and automation in IR and tabletop exercise workflows

Requirements:

• In-depth experience designing and facilitating IR tabletop exercises or similar simulations, including engaging cross-functional participants and turning results into real improvements
• Strong interpersonal skills: calm under pressure, a skilled facilitator, a trusted relationship-builder across teams, and an effective coach and mentor
• Experience in enterprise incident response across the full IR lifecycle
• Good working knowledge of forensics tools (such as Magnet Axiom, Velociraptor, Volatility, FTK, Autopsy) and AWS cloud security fundamentals
• Good understanding of cloud security and AI security concepts
• Must have at least one of the following certifications, or similar: GCIH, GCFA, GCFE, AWS Certified Solutions Architect, or CISSP