Cybersecurity Incident Response Engineer

Kestra Financial is seeking a Cybersecurity Incident Response Engineer to support incident detection, investigation, and response across a diverse enterprise environment. This role works at the intersection of SOC operations, threat hunting, and digital forensics, helping drive faster containment and stronger recovery practices.

Based in Austin, TX (onsite), the engineer will manage SOC escalations, investigate alerts using IDS suite tools, and produce root cause findings that feed mitigation strategy. The position also includes playbook development, audit support, and participation in adversary simulation exercises.

What you will do

• Manage alerts escalated by the SOC and ensure potentially overlooked incidents receive appropriate review.
• Investigate and respond to security incidents using IDS suite tools.
• Conduct root cause analysis and develop mitigation strategies to reduce recurrence.
• Perform audits and support internal and external audit activities with incident response documentation and evidence.
• Collaborate with SOC analysts, IT, and other stakeholders to contain and remediate threats.
• Develop and maintain incident response playbooks and procedures.
• Carry out threat hunting using KQL and Sentinel workbooks.
• Lead digital forensics investigations to identify IOCs, determine attack vectors, and preserve evidence in alignment with legal and organizational standards.
• Contribute to the development and refinement of security policies, procedures, and operational practices.
• Participate in red team and adversary simulation exercises to improve detection and response capabilities.
• Maintain continuous learning by staying up to date with security trends, vulnerabilities, best practices, emerging threats, and security technologies.

What you bring

• 2+ years of proven experience in a similar role.
• Bachelor’s degree in Cybersecurity or IT (or equivalent experience).
• Security+ or equivalent certification (Microsoft security certifications are a plus).
• A strong understanding of Mitre Attack / Cyber Kill-Chain.
• Proficiency or hands-on experience with Microsoft security tooling (a plus).

Tools and technologies

• SIEM, EDR, IDS suite tools
• KQL, Sentinel workbooks
• Microsoft security tooling
• Mitre Attack / Cyber Kill-Chain

Benefits

• Competitive pay and benefits with a large employer (over 1600 employees nationwide).
• 401(k), health insurance, and a competitive benefits package.
• Work in a supportive, collaborative environment committed to professional excellence.
• Opportunities for training, development, and long-term growth within the firm.
• Tuition reimbursement for qualified expenses.
• Support for meaningful client decisions through confidence and guidance.

Internal application policy

• Internal applicants must be in good standing and have a minimum of 1 year of service with Kestra.
• Internal applicants must have a minimum of 1 year service in the current role unless approved by EVP.