Mid Level Incident Response Engineer Jobs
Mid level incident response engineer jobs go to professionals ready to own investigations end to end, mentor junior analysts, and drive containment decisions without waiting for direction. Roles are available across Technology & Software, Education, and Science & Research, with a 67% remote and hybrid share, and employers like TikTok USDS Joint Venture, Google, and Abacus.Ai hiring at this level now.
Find JobsOverview
Showing 5 of 9+ Mid Level Incident Response Engineer jobs
Job Title: Incident Response Analyst (Mid-Senior Level)
Location: REMOTE CYBERSECURITY DIVISION (FTE) Plano, Texas, United States
Job Type: Full-time
Duration: Long term
Experience: 10 Above
Description
We are seeking a skilled and experienced Incident Response Analyst to join our collaborative cybersecurity incident response team within the Threat Research, Response & Analysis Center (TRRAC). In this role, you will combine technical expertise in digital forensics and incident response with proactive threat intelligence and hunting activities. You will respond to critical security incidents across the ecosystem, conduct comprehensive forensic investigations, and collaborate closely with the 24/7 SOC and other cybersecurity teams. When not actively responding to incidents, you will contribute to threat hunting, cyber threat intelligence, tooling improvements, and the development of SOPs and training materials helping to elevate the entire team's capabilities.
Essential Functions
- Conduct comprehensive incident response activities following the NIST Cybersecurity Framework across all phases: Initial Detection, Analysis & Validation, Containment, Eradication, Recovery, and Post-Incident Activity.
- Respond to cyber incidents impacting corporate environments, manufacturing plants, third-parties, dealerships, and RSOC Customers.
- Perform digital forensic investigations including collection, processing, and analysis of forensic evidence from diverse devices (Windows, Linux, macOS, mobile).
- Maintain an "Always Be Timelining" (ABT) approach, continuously updating incident timelines as findings are discovered.
- Support proactive, reactive, and exploratory threat hunting activities across the ecosystem.
- Analyze emerging cyber threats, attacker TTPs, and track threat actors/groups to anticipate and mitigate potential attacks.
- Collaborate closely with the 24/7 SOC, Threat Detection Engineering, Vulnerability Management, and Insider Risk Management teams.
- Prepare and deliver forensic reports, incident communications, and executive updates during active incidents.
- Participate in weekly on-call rotation schedule for 24/7 incident response coverage.
- Conduct malware analysis (behavioral and static) using TRRAC Labs' dynamic analysis capabilities.
- Help develop, refine, and maintain incident response playbooks, SOPs, and training materials to improve team effectiveness.
- Participate in quarterly tabletop exercises to test incident response workflows and controls.
- Stay current on emerging threats, attacker techniques, and industry best practices.
Requirements
- Minimum of 3-5 years of hands-on experience in incident response and digital forensics.
- Proven ability to act as Incident Commander within a team setting during high-pressure incidents.
- Strong technical expertise in Windows, Linux, and macOS internals related to monitoring and threat detection.
- Experience with cloud security incident response and threat mitigation.
- Skilled in malware analysis (behavioral and static) and basic cryptanalysis.
- Familiarity with security frameworks and compliance standards (NIST, HIPAA, ISO, OWASP, etc.).
- Proficient with DFIR tools such as Autopsy, The Sleuth Kit, Volatility, Magnet Axiom, FTK, and others.
- Competent in scripting languages like Python, PowerShell, and Bash for automation and analysis.
- Excellent communication skills with the ability to collaborate effectively across technical teams and stakeholders.
Preferred / Bonus Skills
- Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field (preferred or equivalent experience).
- Experience in enterprise, manufacturing, or software industries.
- Familiarity with SOAR platforms and security automation.
- Prior experience contributing to or improving incident response programs in a team environment.
Why Join Us?
Be part of a skilled, collaborative incident response team where your expertise helps drive collective success. Lead and support incident response efforts alongside experienced peers. Continuously grow your skills through diverse investigations, threat hunting, and team knowledge sharing. Help shape and improve our incident response processes and training.
Job Title: Incident Response Analyst (Mid-Senior Level)
Location: REMOTE CYBERSECURITY DIVISION (FTE) Plano, Texas, United States
Job Type: Full-time
Duration: Long term
Experience: 10 Above
Description
We are seeking a skilled and experienced Incident Response Analyst to join our collaborative cybersecurity incident response team within the Threat Research, Response & Analysis Center (TRRAC). In this role, you will combine technical expertise in digital forensics and incident response with proactive threat intelligence and hunting activities. You will respond to critical security incidents across the ecosystem, conduct comprehensive forensic investigations, and collaborate closely with the 24/7 SOC and other cybersecurity teams. When not actively responding to incidents, you will contribute to threat hunting, cyber threat intelligence, tooling improvements, and the development of SOPs and training materials helping to elevate the entire team's capabilities.
Essential Functions
- Conduct comprehensive incident response activities following the NIST Cybersecurity Framework across all phases: Initial Detection, Analysis & Validation, Containment, Eradication, Recovery, and Post-Incident Activity.
- Respond to cyber incidents impacting corporate environments, manufacturing plants, third-parties, dealerships, and RSOC Customers.
- Perform digital forensic investigations including collection, processing, and analysis of forensic evidence from diverse devices (Windows, Linux, macOS, mobile).
- Maintain an "Always Be Timelining" (ABT) approach, continuously updating incident timelines as findings are discovered.
- Support proactive, reactive, and exploratory threat hunting activities across the ecosystem.
- Analyze emerging cyber threats, attacker TTPs, and track threat actors/groups to anticipate and mitigate potential attacks.
- Collaborate closely with the 24/7 SOC, Threat Detection Engineering, Vulnerability Management, and Insider Risk Management teams.
- Prepare and deliver forensic reports, incident communications, and executive updates during active incidents.
- Participate in weekly on-call rotation schedule for 24/7 incident response coverage.
- Conduct malware analysis (behavioral and static) using TRRAC Labs' dynamic analysis capabilities.
- Help develop, refine, and maintain incident response playbooks, SOPs, and training materials to improve team effectiveness.
- Participate in quarterly tabletop exercises to test incident response workflows and controls.
- Stay current on emerging threats, attacker techniques, and industry best practices.
Requirements
- Minimum of 3-5 years of hands-on experience in incident response and digital forensics.
- Proven ability to act as Incident Commander within a team setting during high-pressure incidents.
- Strong technical expertise in Windows, Linux, and macOS internals related to monitoring and threat detection.
- Experience with cloud security incident response and threat mitigation.
- Skilled in malware analysis (behavioral and static) and basic cryptanalysis.
- Familiarity with security frameworks and compliance standards (NIST, HIPAA, ISO, OWASP, etc.).
- Proficient with DFIR tools such as Autopsy, The Sleuth Kit, Volatility, Magnet Axiom, FTK, and others.
- Competent in scripting languages like Python, PowerShell, and Bash for automation and analysis.
- Excellent communication skills with the ability to collaborate effectively across technical teams and stakeholders.
Preferred / Bonus Skills
- Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field (preferred or equivalent experience).
- Experience in enterprise, manufacturing, or software industries.
- Familiarity with SOAR platforms and security automation.
- Prior experience contributing to or improving incident response programs in a team environment.
Why Join Us?
Be part of a skilled, collaborative incident response team where your expertise helps drive collective success. Lead and support incident response efforts alongside experienced peers. Continuously grow your skills through diverse investigations, threat hunting, and team knowledge sharing. Help shape and improve our incident response processes and training.
See All 9 Mid Level Incident Response Engineer Jobs
Find roles that match your experience and apply in just a few clicks.
Find JobsMid Level Incident Response Engineer Job Market
Who's Hiring
Top Industries Hiring
- Technology & Software
- Education
- Science & Research
- Sports & Recreation
Mid Level Incident Response Engineer Jobs: Frequently Asked Questions
How do I get a mid level incident response engineer job?
Highlight ownership, not just participation: applications that show you led investigations, wrote post-incident reports, or improved detection rules stand out over those listing tools alone. Tailor your resume to the specific threat environment each employer faces, demonstrate comfort with a full incident lifecycle from triage to lessons learned, and be ready to discuss at least one complex incident you drove from detection through remediation.
Which companies hire mid level incident response engineers?
Companies hiring mid level incident response engineers right now include TikTok USDS Joint Venture, Google, and Abacus.Ai, based on current listings on Migrate Mate as of November 2026. Hiring at this level covers large enterprises with mature security operations centers, government contractors, financial institutions, and growth-stage technology companies building out their incident response capabilities.
Are there remote mid level incident response engineer jobs?
Yes, though availability varies by employer and sensitivity of the environment. About 67% of mid level incident response engineer openings are remote or hybrid as of November 2026, with fully on-site roles more common in regulated industries like defense and finance where classified systems or compliance requirements limit remote access.
How do I move up to a mid level incident response engineer role?
The progression from entry level centers on accumulating owned outcomes, not just completed tasks. Build depth in at least one area such as malware analysis, digital forensics, or threat hunting, and take on full ownership of incidents rather than supporting a senior engineer. Document measurable impact, such as mean time to containment improvements or detection rules you authored, and seek environments where you can lead response efforts independently.
Which industries hire the most mid level incident response engineers?
Mid Level incident response engineer roles concentrate in Technology & Software, Education, and Science & Research, based on current listings on Migrate Mate as of November 2026. These sectors drive hiring at this level because their regulatory obligations, large attack surfaces, and sensitive data make mature, experienced incident response capacity a business-critical function rather than a nice-to-have.