Principal Security Engineer, Incident Response

Lead incident response at an enterprise scale by directing investigations, containment, eradication, and recovery across Advance Auto Parts’ environment.

Responsibilities

• Lead technical response for high-severity cybersecurity incidents from detection through closure.
• Act as technical lead and deputy to the Incident Commander during major cybersecurity events.
• Investigate and respond to ransomware, malware, business email compromise, credential theft, cloud compromise, insider threats, and third-party breaches.
• Perform forensic analysis across hosts, networks, memory, logs, and cloud to identify root cause, scope, and impact.
• Coordinate with Technology and business teams to execute containment, eradication, and recovery actions.
• Preserve evidence and maintain chain of custody to support legal, regulatory, privacy, and cyber insurance needs.
• Escalate complex or ambiguous security events to guide junior incident responders.
• Provide timely incident documentation, technical findings, and status updates for leadership.
• Run proactive, hypothesis-driven threat hunts to identify advanced attacker activity.
• Convert incident learnings into new or improved detections aligned to MITRE ATT&CK.
• Partner with Engineering to tune monitoring technologies and improve signal-to-noise ratios.
• Use threat intelligence to enrich investigations and anticipate threat actor TTPs targeting the retail industry.
• Identify automation opportunities for triage, enrichment, and response actions.
• Develop, maintain, and test incident response playbooks to keep them current and actionable.
• Support tabletop exercises, ransomware preparedness exercises, and cyber crisis simulations.
• Lead post-incident reviews and ensure corrective actions are tracked through completion.
• Contribute incident data to operational metrics, including MTTD and MTTR.
• Mentor and develop junior incident responders via case reviews and hands-on coaching.
• Share knowledge through runbooks, training sessions, and lessons learned.
• Coordinate with external IR retainers, forensic vendors, and law enforcement as directed.
• Model a culture of accountability, resilience, and continuous improvement.

Requirements

• 6+ years of experience in cybersecurity, including at least 3 years in incident response, digital forensics, or threat hunting.
• Demonstrated experience leading investigations involving ransomware, business email compromise, cloud, and identity-based attacks.
• Hands-on expertise with security technologies: SIEM, SOAR, EDR, cloud security tools, and network and forensic analysis tools.
• Working knowledge of Windows, Linux, Active Directory/Entra ID, and major cloud platforms: AWS, Azure, or GCP.
• Experience with cybersecurity frameworks: NIST SP 800-61, NIST CSF, MITRE ATT&CK.
• Scripting experience with Python, PowerShell, or similar to support investigations and automation.
• Excellent written and verbal communication skills, including the ability to explain technical findings to non-technical audiences.

Technologies

• SIEM, SOAR, EDR
• Cloud security tools
• Network and forensic analysis tools
• Windows, Linux
• Active Directory, Entra ID
• AWS, Azure, GCP
• Python, PowerShell
• NIST SP 800-61, NIST CSF
• MITRE ATT&CK

Benefits

• Comprehensive health & wellness benefits (see https://jobs.advanceautoparts.com/us/en/benefits)

Preferred Qualifications

• Certifications: GCIH, GCFA, GCFE, GNFA, GREM, CISSP.
• Experience in large-scale, complex organizations, retail, or highly regulated industries.
• Expertise in cybersecurity automation and analytics.

Certifications, Experience, and Education

• Certifications: GCIH, GCFA, GCFE, GNFA, GREM, CISSP

Location & Work Availability

• Raleigh, NC (Hybrid): 4 days in office, 1 day remote
• Based at corporate headquarters in Raleigh, North Carolina