Ransomware Response Cybersecurity Jobs

1 job found

Today

Principal Security Engineer, Incident Response

Advance Auto Parts Raleigh, NC

Raleigh, NC

Today

Full time Cloud Platforms Cybersecurity Operations Cybersecurity Tools

Apply Now

Job Description

Lead incident response at an enterprise scale by directing investigations, containment, eradication, and recovery across Advance Auto Parts’ environment.

Responsibilities

Lead technical response for high-severity cybersecurity incidents from detection through closure.
Act as technical lead and deputy to the Incident Commander during major cybersecurity events.
Investigate and respond to ransomware, malware, business email compromise, credential theft, cloud compromise, insider threats, and third-party breaches.
Perform forensic analysis across hosts, networks, memory, logs, and cloud to identify root cause, scope, and impact.
Coordinate with Technology and business teams to execute containment, eradication, and recovery actions.
Preserve evidence and maintain chain of custody to support legal, regulatory, privacy, and cyber insurance needs.
Escalate complex or ambiguous security events to guide junior incident responders.
Provide timely incident documentation, technical findings, and status updates for leadership.
Run proactive, hypothesis-driven threat hunts to identify advanced attacker activity.
Convert incident learnings into new or improved detections aligned to MITRE ATT&CK.
Partner with Engineering to tune monitoring technologies and improve signal-to-noise ratios.
Use threat intelligence to enrich investigations and anticipate threat actor TTPs targeting the retail industry.
Identify automation opportunities for triage, enrichment, and response actions.
Develop, maintain, and test incident response playbooks to keep them current and actionable.
Support tabletop exercises, ransomware preparedness exercises, and cyber crisis simulations.
Lead post-incident reviews and ensure corrective actions are tracked through completion.
Contribute incident data to operational metrics, including MTTD and MTTR.
Mentor and develop junior incident responders via case reviews and hands-on coaching.
Share knowledge through runbooks, training sessions, and lessons learned.
Coordinate with external IR retainers, forensic vendors, and law enforcement as directed.
Model a culture of accountability, resilience, and continuous improvement.

Requirements

6+ years of experience in cybersecurity, including at least 3 years in incident response, digital forensics, or threat hunting.
Demonstrated experience leading investigations involving ransomware, business email compromise, cloud, and identity-based attacks.
Hands-on expertise with security technologies: SIEM, SOAR, EDR, cloud security tools, and network and forensic analysis tools.
Working knowledge of Windows, Linux, Active Directory/Entra ID, and major cloud platforms: AWS, Azure, or GCP.
Experience with cybersecurity frameworks: NIST SP 800-61, NIST CSF, MITRE ATT&CK.
Scripting experience with Python, PowerShell, or similar to support investigations and automation.
Excellent written and verbal communication skills, including the ability to explain technical findings to non-technical audiences.

Technologies

SIEM, SOAR, EDR
Cloud security tools
Network and forensic analysis tools
Windows, Linux
Active Directory, Entra ID
AWS, Azure, GCP
Python, PowerShell
NIST SP 800-61, NIST CSF
MITRE ATT&CK

Benefits

Comprehensive health & wellness benefits (see https://jobs.advanceautoparts.com/us/en/benefits)

Preferred Qualifications

Certifications: GCIH, GCFA, GCFE, GNFA, GREM, CISSP.
Experience in large-scale, complex organizations, retail, or highly regulated industries.
Expertise in cybersecurity automation and analytics.

Certifications, Experience, and Education

Certifications: GCIH, GCFA, GCFE, GNFA, GREM, CISSP

Location & Work Availability

Raleigh, NC (Hybrid): 4 days in office, 1 day remote
Based at corporate headquarters in Raleigh, North Carolina

View full job page →

Get Ransomware Response Cybersecurity Jobs alerts

New Ransomware Response Cybersecurity Jobs, daily.