STEM OPT Incident Response Engineer Jobs
Incident Response Engineer roles in threat detection, forensic analysis, and security operations qualify for the STEM OPT 24-month extension when your degree maps to an eligible CIP code. Your employer must be enrolled in E-Verify and sign a Form I-983 training plan before your extension begins.
Find STEM OPT Incident Response Engineer JobsOverview
Showing 5 of 12+ Incident Response Engineer jobs
See all Incident Response Engineer Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Incident Response Engineer roles.
Get Access To All JobsResponsibilities
About the Team
The USDS JV Threat Detection and Response team is responsible for protecting TikTok’s people, data, and systems from threats that originate within the organization. We partner across Security, Legal, HR, IT, and Engineering to detect, investigate, and mitigate insider risks ranging from data exfiltration and policy violations to fraud and unauthorized access.
About the Role
As a Senior Analyst on the USJV Forensics & Response team, you will be at the forefront of our organization's digital investigations and incident response (DFIR) efforts. In this critical position, you will lead complex forensic investigations across a diverse technical landscape, including enterprise endpoints, servers, mobile devices, data platforms, and cloud infrastructure.
Responsibilities
- Incident Investigations & Response: Perform digital forensic investigations of endpoints, servers, mobile devices, data platforms, internal systems, and cloud infrastructure.
- Evidence Acquisition & Preservation: Identify, collect, image, and preserve physical and digital evidence in strict adherence to chain-of-custody protocols and legal standards.
- Data Analytics: Analyze complex data queries, trace data lineage, and assess outputs for data residency and compliance issues.
- Artifact & Malware Analysis: Analyze endpoints, file system artifacts, memory dumps, and network traffic to identify root cause, scope of incident, and TTPs.
- Reporting & Documentation: Author detailed forensic reports outlining technical findings, timeline of events, root cause analysis, and remediation recommendations.
- Legal & Compliance Support: Assist with internal investigations, eDiscovery requests, and coordinate with legal teams or law enforcement when necessary.
- Lab & Equipment Management: Maintain, configure, and upgrade the hardware, software, and network infrastructure of the digital forensics laboratory. Ensure go-kits and remote acquisition equipment is prepared for response scenarios.
Qualifications
Minimum Qualifications
- 1 year of experience in digital forensics & incident response, cybersecurity engineering, or data analytics experience.
- Strong understanding of Windows, Linux, and macOS file systems (NTFS, EXT4, APFS) and forensic artifacts.
- Moderate report writing skills, detailing analysis, procedures performed, and findings, capable of being consumed by executive-level stakeholders.
- Moderate hands-on experience with evidence handling, chain-of-custody, and contemporaneous note taking.
Preferred Qualifications
- Exposure to data analytics, analyzing complex SQL queries, data tasks, data lineage, and outputs.
- Exposure to scripting in Python, Bash, or PowerShell for automation and log parsing.
- Exposure to working with cloud platforms (OCI, AWS, Azure, or GCP).
- Hands-on technical experience investigating, responding to high-stakes incidents, including the ability to work effectively with engineers and technical operators.
- Experience analyzing varying data structures, including Apache Hive, ClickHouse, RDS, and Redis.
- Experience operating in regulated environments, with strict compliance requirements, supporting audits and evidence requests.
- Bachelor's in cybersecurity engineering, computer science, or digital forensics; OR have equivalent industry experience.
- Relevant Certifications: GCIH, GCIA, GIME, GCFE, GCFA, GREM, or equivalent.
About USDS
TikTok USDS Joint Venture LLC is dedicated to the safety and security of millions of Americans who create, discover, and connect with what they love on the apps we operate. The Joint Venture has been established in compliance with the Executive Order signed by President Trump on September 25, 2025. Our foundation is a comprehensive data privacy and cybersecurity program we operate under defined safeguards to protect national security and secure U.S. user data, apps and the algorithm. We safeguard the U.S. content ecosystem, holding decision-making authority for trust and safety policies and moderation. USDS Joint Venture helps ensure Americans can continue to express their creativity, discover new hobbies and interests, and build thriving communities and businesses on a global scale.
On-site presence across teams allows the company to operate with greater speed, alignment, and agility — especially in areas like real-time decision-making, team development, and integrated execution. As such, the company is shifting from a hybrid work model to a fully in-person schedule up to 5 days a week.
Why Join Us
Inspiring creativity is at the core of TikTok's mission. Our innovative product is built to help people authentically express themselves, discover and connect – and our global, diverse teams make that possible. Together, we create value for our communities, inspire creativity and bring joy – a mission we work towards every day. We strive to do great things with great people. We lead with curiosity, humility, and a desire to make impact in a rapidly growing tech company. Every challenge is an opportunity to learn and innovate as one team. We're resilient and embrace challenges as they come. By constantly iterating and fostering an "Always Day 1" mindset, we achieve meaningful breakthroughs for ourselves, our company, and our users. When we create and grow together, the possibilities are limitless. Join us.
Diversity & Inclusion
TikTok is committed to creating an inclusive space where employees are valued for their skills, experiences, and unique perspectives. Our platform connects people from across the globe and so does our workplace. At TikTok, our mission is to inspire creativity and bring joy. To achieve that goal, we are committed to celebrating our diverse voices and to creating an environment that reflects the many communities we reach. We are passionate about this and hope you are too.
USDS Reasonable Accommodation
USDS is committed to providing reasonable accommodations in our recruitment processes for candidates with disabilities, pregnancy, sincerely held religious beliefs or other reasons protected by applicable laws. If you need assistance or a reasonable accommodation, please reach out to us at https://tinyurl.com/USDS-RA
Job Information
【For Pay Transparency】 Compensation Description (Annually)
- Washington, DC The base salary range for this position in the selected city is $88,920 - $176,400 annually.
Compensation may vary outside of this range depending on a number of factors, including a candidate’s qualifications, skills, competencies and experience, and location. Base pay is one part of the Total Package that is provided to compensate and recognize employees for their work, and this role may be eligible for additional discretionary bonuses/incentives, and restricted stock units.
Benefits may vary depending on the nature of employment and the country work location. Employees have day one access to medical, dental, and vision insurance, a 401(k) savings plan with company match, paid parental leave, short-term and long-term disability coverage, life insurance, wellbeing benefits, among others. Employees also receive 10 paid holidays per year, 10 paid sick days per year and 17 days of Paid Personal Time (prorated upon hire with increasing accruals by tenure).
The Company reserves the right to modify or change these benefits programs at any time, with or without notice.
Responsibilities
About the Team
The USDS JV Threat Detection and Response team is responsible for protecting TikTok’s people, data, and systems from threats that originate within the organization. We partner across Security, Legal, HR, IT, and Engineering to detect, investigate, and mitigate insider risks ranging from data exfiltration and policy violations to fraud and unauthorized access.
About the Role
As a Senior Analyst on the USJV Forensics & Response team, you will be at the forefront of our organization's digital investigations and incident response (DFIR) efforts. In this critical position, you will lead complex forensic investigations across a diverse technical landscape, including enterprise endpoints, servers, mobile devices, data platforms, and cloud infrastructure.
Responsibilities
- Incident Investigations & Response: Perform digital forensic investigations of endpoints, servers, mobile devices, data platforms, internal systems, and cloud infrastructure.
- Evidence Acquisition & Preservation: Identify, collect, image, and preserve physical and digital evidence in strict adherence to chain-of-custody protocols and legal standards.
- Data Analytics: Analyze complex data queries, trace data lineage, and assess outputs for data residency and compliance issues.
- Artifact & Malware Analysis: Analyze endpoints, file system artifacts, memory dumps, and network traffic to identify root cause, scope of incident, and TTPs.
- Reporting & Documentation: Author detailed forensic reports outlining technical findings, timeline of events, root cause analysis, and remediation recommendations.
- Legal & Compliance Support: Assist with internal investigations, eDiscovery requests, and coordinate with legal teams or law enforcement when necessary.
- Lab & Equipment Management: Maintain, configure, and upgrade the hardware, software, and network infrastructure of the digital forensics laboratory. Ensure go-kits and remote acquisition equipment is prepared for response scenarios.
Qualifications
Minimum Qualifications
- 1 year of experience in digital forensics & incident response, cybersecurity engineering, or data analytics experience.
- Strong understanding of Windows, Linux, and macOS file systems (NTFS, EXT4, APFS) and forensic artifacts.
- Moderate report writing skills, detailing analysis, procedures performed, and findings, capable of being consumed by executive-level stakeholders.
- Moderate hands-on experience with evidence handling, chain-of-custody, and contemporaneous note taking.
Preferred Qualifications
- Exposure to data analytics, analyzing complex SQL queries, data tasks, data lineage, and outputs.
- Exposure to scripting in Python, Bash, or PowerShell for automation and log parsing.
- Exposure to working with cloud platforms (OCI, AWS, Azure, or GCP).
- Hands-on technical experience investigating, responding to high-stakes incidents, including the ability to work effectively with engineers and technical operators.
- Experience analyzing varying data structures, including Apache Hive, ClickHouse, RDS, and Redis.
- Experience operating in regulated environments, with strict compliance requirements, supporting audits and evidence requests.
- Bachelor's in cybersecurity engineering, computer science, or digital forensics; OR have equivalent industry experience.
- Relevant Certifications: GCIH, GCIA, GIME, GCFE, GCFA, GREM, or equivalent.
About USDS
TikTok USDS Joint Venture LLC is dedicated to the safety and security of millions of Americans who create, discover, and connect with what they love on the apps we operate. The Joint Venture has been established in compliance with the Executive Order signed by President Trump on September 25, 2025. Our foundation is a comprehensive data privacy and cybersecurity program we operate under defined safeguards to protect national security and secure U.S. user data, apps and the algorithm. We safeguard the U.S. content ecosystem, holding decision-making authority for trust and safety policies and moderation. USDS Joint Venture helps ensure Americans can continue to express their creativity, discover new hobbies and interests, and build thriving communities and businesses on a global scale.
On-site presence across teams allows the company to operate with greater speed, alignment, and agility — especially in areas like real-time decision-making, team development, and integrated execution. As such, the company is shifting from a hybrid work model to a fully in-person schedule up to 5 days a week.
Why Join Us
Inspiring creativity is at the core of TikTok's mission. Our innovative product is built to help people authentically express themselves, discover and connect – and our global, diverse teams make that possible. Together, we create value for our communities, inspire creativity and bring joy – a mission we work towards every day. We strive to do great things with great people. We lead with curiosity, humility, and a desire to make impact in a rapidly growing tech company. Every challenge is an opportunity to learn and innovate as one team. We're resilient and embrace challenges as they come. By constantly iterating and fostering an "Always Day 1" mindset, we achieve meaningful breakthroughs for ourselves, our company, and our users. When we create and grow together, the possibilities are limitless. Join us.
Diversity & Inclusion
TikTok is committed to creating an inclusive space where employees are valued for their skills, experiences, and unique perspectives. Our platform connects people from across the globe and so does our workplace. At TikTok, our mission is to inspire creativity and bring joy. To achieve that goal, we are committed to celebrating our diverse voices and to creating an environment that reflects the many communities we reach. We are passionate about this and hope you are too.
USDS Reasonable Accommodation
USDS is committed to providing reasonable accommodations in our recruitment processes for candidates with disabilities, pregnancy, sincerely held religious beliefs or other reasons protected by applicable laws. If you need assistance or a reasonable accommodation, please reach out to us at https://tinyurl.com/USDS-RA
Job Information
【For Pay Transparency】 Compensation Description (Annually)
- Washington, DC The base salary range for this position in the selected city is $88,920 - $176,400 annually.
Compensation may vary outside of this range depending on a number of factors, including a candidate’s qualifications, skills, competencies and experience, and location. Base pay is one part of the Total Package that is provided to compensate and recognize employees for their work, and this role may be eligible for additional discretionary bonuses/incentives, and restricted stock units.
Benefits may vary depending on the nature of employment and the country work location. Employees have day one access to medical, dental, and vision insurance, a 401(k) savings plan with company match, paid parental leave, short-term and long-term disability coverage, life insurance, wellbeing benefits, among others. Employees also receive 10 paid holidays per year, 10 paid sick days per year and 17 days of Paid Personal Time (prorated upon hire with increasing accruals by tenure).
The Company reserves the right to modify or change these benefits programs at any time, with or without notice.
See all STEM OPT Incident Response Engineer Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new STEM OPT Incident Response Engineer Jobs.
Get Access To All JobsTips for Finding STEM OPT Authorization as an Incident Response Engineer
Verify your CIP code before applying
Confirm your degree's Classification of Instructional Programs code maps to a STEM-designated field like Computer Science or Information Security. Your DSO can check your I-20 against the official STEM CIP list, a mismatch disqualifies you from the 24-month extension regardless of your job duties.
Screen employers for E-Verify enrollment early
Incident Response Engineer roles often sit inside security or IT operations teams at companies that don't always advertise their E-Verify status. Ask the recruiter directly during a first call, STEM OPT is void if your employer isn't enrolled in E-Verify before your extension start date.
Negotiate your I-983 training plan before accepting
Your employer must complete Form I-983 detailing how your Incident Response duties connect to your STEM degree. Raise this before signing an offer, some hiring managers in security operations have never filed one, and delays getting it signed can push your extension start date.
Use Migrate Mate to target verified sponsors
Search Incident Response Engineer roles on Migrate Mate, which filters for employers with confirmed E-Verify enrollment and active STEM OPT hiring history. This cuts out the manual verification step and surfaces companies already familiar with the I-983 and 24-month extension process.
Map your resume to O*NET's IR Engineer tasks
Pull the Incident Response Engineer occupation profile from O*NET and align your resume skills to its listed tasks: threat containment, forensic investigation, and post-incident reporting. Employers filing STEM OPT extensions reference SOC codes, so matching your experience to standard task language strengthens your I-983 training plan.
Time your H-1B registration around your OPT end date
If your STEM OPT extension runs through an H-1B lottery cycle, cap-gap protection automatically extends your work authorization if you're selected. Submit your registration in March during your final OPT year so any cap-gap gap between October 1 and your extension's expiry is covered by USCIS rules.
Frequently Asked Questions
Does an Incident Response Engineer role qualify for the STEM OPT extension?
Yes, if your underlying degree carries an eligible STEM CIP code and your job duties in threat detection, digital forensics, or security operations directly relate to that field. The role itself doesn't confer eligibility, your degree does. Confirm the CIP code on your I-20 with your DSO before your employer files the I-983 training plan, since USCIS evaluates the degree-to-job connection during any request for evidence.
What does my employer need to do before my STEM OPT extension starts?
Your employer must be enrolled in E-Verify and must sign Form I-983, the Training Plan for STEM OPT Students, before your extension begins. The I-983 requires them to document how your Incident Response duties relate to your STEM degree, set learning objectives, and attest that the position is paid and meets labor standards. You then submit the signed I-983 to your DSO, who issues a new I-20 for the USCIS extension filing.
How do I confirm a company is enrolled in E-Verify before accepting an offer?
Ask the recruiter or HR contact directly whether the company is enrolled in E-Verify. Employers can also be searched through the E-Verify employer search tool maintained by DHS. For security-sector companies that may have government contracts, E-Verify enrollment is often mandatory by federal regulation, but enrollment still needs confirmation, don't assume based on company size or contract status alone.
Which STEM degrees typically support an Incident Response Engineer STEM OPT extension?
Degrees in Computer Science, Information Security, Cybersecurity, Computer Engineering, and Electrical Engineering commonly carry eligible STEM CIP codes. Some programs in Management Information Systems or Applied Mathematics also qualify depending on the specific CIP code your school assigned. A degree titled broadly, like Information Technology, may or may not qualify, so verify the exact CIP code on your I-20 against the DHS STEM Designated Degree Program List before counting on the extension.
Where can I find Incident Response Engineer jobs where employers are already set up to hire STEM OPT students?
Migrate Mate lists Incident Response Engineer positions filtered for employers with E-Verify enrollment and documented STEM OPT hiring activity. That saves you from discovering mid-offer that a company has never processed an I-983 or isn't enrolled in E-Verify. Targeting employers who have already navigated the training plan process significantly reduces the risk of delays between your OPT expiry and extension approval.