STEM OPT Incident Response Engineer Jobs
Incident Response Engineer roles in threat detection, forensic analysis, and security operations qualify for the STEM OPT 24-month extension when your degree maps to an eligible CIP code. Your employer must be enrolled in E-Verify and sign a Form I-983 training plan before your extension begins.
See All Incident Response Engineer JobsOverview
Showing 5 of 10+ Incident Response Engineer jobs
Have you applied for this role?
Have you applied for this role?
Have you applied for this role?
Have you applied for this role?
Have you applied for this role?
See all Incident Response Engineer jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Incident Response Engineer roles.
Get Access To All JobsPosition Summary
Role summary:
The Senior Incident Response Engineer will lead the development and execution of cyber incident response procedures to mitigate and contain threats across environments. This role involves driving investigations of external and insider threats, mentoring team members, and enhancing detection and mitigation processes. The position requires expertise in vulnerability assessment, threat intelligence analysis, and cyber risk management to protect organizational assets. The engineer will collaborate with stakeholders to communicate findings and implement security improvements, ensuring adherence to industry standards and advancing the company’s cybersecurity posture through proactive and strategic incident management.
About the team:
Walmart’s Global CSIRT protects one of the world’s largest retail ecosystems by providing continuous, 24/7 incident response across multiple countries and platforms. The team investigates and mitigates cyber threats to reduce business impact and uphold customer trust. Working closely with engineering, infrastructure, legal, compliance, and leadership, the team ensures effective incident management and security enhancements. Beyond response activities, the team advances Walmart’s security posture through intelligence-driven defense and lessons learned. This role offers the opportunity to contribute to a global cyber defense operation with precision and strong cross-functional collaboration.
What you'll do:
- Lead and execute cyber incident response activities, including detection, containment, and mitigation across network and cloud environments.
- Investigate external and insider threats, conducting malware analysis and forensic examinations to identify root causes.
- Develop and refine incident response procedures and playbooks aligned with industry standards such as NIST and ISO27001.
- Perform vulnerability assessments and penetration testing to identify and remediate security weaknesses.
- Analyze threat intelligence to inform proactive defense strategies and communicate findings to stakeholders.
- Mentor team members on incident handling and support continuous improvement of response capabilities.
- Collaborate with cross-functional teams to manage cyber risk and enhance security posture.
What you'll bring:
- Extensive experience in cyber incident response, including knowledge of incident phases and mitigation strategies.
- Proficiency with security standards such as NIST 800-53, ISO27001, and Cloud Security Alliance frameworks.
- Strong skills in malware analysis, vulnerability assessment, and penetration testing methodologies.
- Expertise in threat intelligence analysis and application of the MITRE ATT&CK Framework.
- Ability to lead investigations of cyber threats and insider incidents while mentoring team members.
- Competence in stakeholder management and effective incident communication.
- GIAC Certified Incident Handler or equivalent certification preferred.
At Walmart, we offer competitive pay as well as performance-based bonus awards and other great benefits for a happier mind, body, and wallet. Health benefits include medical, vision and dental coverage. Financial benefits include 401(k), stock purchase and company-paid life insurance. Paid time off benefits include PTO (including sick leave), parental leave, family care leave, bereavement, jury duty, and voting. Other benefits include short-term and long-term disability, company discounts, Military Leave Pay, adoption and surrogacy expense reimbursement, and more. You will also receive PTO and/or PPTO that can be used for vacation, sick leave, holidays, or other purposes. The amount you receive depends on your job classification and length of employment. It will meet or exceed the requirements of paid sick leave laws, where applicable. For information about PTO, see https://one.walmart.com/notices. Live Better U is a Walmart-paid education benefit program for full-time and part-time associates in Walmart and Sam's Club facilities. Programs range from high school completion to bachelor's degrees, including English Language Learning and short-form certificates. Tuition, books, and fees are completely paid for by Walmart.
Eligibility requirements apply to some benefits and may depend on your job classification and length of employment. Benefits are subject to change and may be subject to a specific plan or program terms.
For information about benefits and eligibility, see One.Walmart.
LOCATION
Herndon, Virginia US-10710: The annual salary range for this position is $108,000.00 - $216,000.00
Bentonville, Arkansas US-09050: The annual salary range for this position is $90,000.00 - $180,000.00 Additional compensation includes annual or quarterly performance bonuses. Additional compensation for certain positions may also include:
- Stock
Minimum Qualifications
Option 1: Bachelor's degree in computer science, information technology, engineering, information systems, cybersecurity, or related area and 3 years’ experience in incident response or related area at a technology, retail, or data-driven company. Option 2: 5 years’ experience in incident response or related area at a technology, retail, or data-driven company.
Preferred Qualifications
Certifications in Security+, Network+, GISF, GSEC, CISSP, CCSP, or GCIH, Master’s degree in Computer Science, Information Technology, Engineering, Information Systems, Cybersecurity, or related area and 1 Years' Exposure of leading/working on Information Security/Cyber Security Projects. We value candidates with a background in creating inclusive digital experiences, demonstrating knowledge in implementing Web Content Accessibility Guidelines (WCAG) 2.2 AA standards, assistive technologies, and integrating digital accessibility seamlessly. The ideal candidate would have knowledge of accessibility best practices and join us as we continue to create accessible products and services following Walmart’s accessibility standards and guidelines for supporting an inclusive culture. CISSP - Certified Information Systems Security Professional - Certification.
Walmart and its subsidiaries are committed to maintaining a drug-free workplace and has a no tolerance policy regarding the use of illegal drugs and alcohol on the job. This policy applies to all employees and aims to create a safe and productive work environment.
Position Summary
Role summary:
The Senior Incident Response Engineer will lead the development and execution of cyber incident response procedures to mitigate and contain threats across environments. This role involves driving investigations of external and insider threats, mentoring team members, and enhancing detection and mitigation processes. The position requires expertise in vulnerability assessment, threat intelligence analysis, and cyber risk management to protect organizational assets. The engineer will collaborate with stakeholders to communicate findings and implement security improvements, ensuring adherence to industry standards and advancing the company’s cybersecurity posture through proactive and strategic incident management.
About the team:
Walmart’s Global CSIRT protects one of the world’s largest retail ecosystems by providing continuous, 24/7 incident response across multiple countries and platforms. The team investigates and mitigates cyber threats to reduce business impact and uphold customer trust. Working closely with engineering, infrastructure, legal, compliance, and leadership, the team ensures effective incident management and security enhancements. Beyond response activities, the team advances Walmart’s security posture through intelligence-driven defense and lessons learned. This role offers the opportunity to contribute to a global cyber defense operation with precision and strong cross-functional collaboration.
What you'll do:
- Lead and execute cyber incident response activities, including detection, containment, and mitigation across network and cloud environments.
- Investigate external and insider threats, conducting malware analysis and forensic examinations to identify root causes.
- Develop and refine incident response procedures and playbooks aligned with industry standards such as NIST and ISO27001.
- Perform vulnerability assessments and penetration testing to identify and remediate security weaknesses.
- Analyze threat intelligence to inform proactive defense strategies and communicate findings to stakeholders.
- Mentor team members on incident handling and support continuous improvement of response capabilities.
- Collaborate with cross-functional teams to manage cyber risk and enhance security posture.
What you'll bring:
- Extensive experience in cyber incident response, including knowledge of incident phases and mitigation strategies.
- Proficiency with security standards such as NIST 800-53, ISO27001, and Cloud Security Alliance frameworks.
- Strong skills in malware analysis, vulnerability assessment, and penetration testing methodologies.
- Expertise in threat intelligence analysis and application of the MITRE ATT&CK Framework.
- Ability to lead investigations of cyber threats and insider incidents while mentoring team members.
- Competence in stakeholder management and effective incident communication.
- GIAC Certified Incident Handler or equivalent certification preferred.
At Walmart, we offer competitive pay as well as performance-based bonus awards and other great benefits for a happier mind, body, and wallet. Health benefits include medical, vision and dental coverage. Financial benefits include 401(k), stock purchase and company-paid life insurance. Paid time off benefits include PTO (including sick leave), parental leave, family care leave, bereavement, jury duty, and voting. Other benefits include short-term and long-term disability, company discounts, Military Leave Pay, adoption and surrogacy expense reimbursement, and more. You will also receive PTO and/or PPTO that can be used for vacation, sick leave, holidays, or other purposes. The amount you receive depends on your job classification and length of employment. It will meet or exceed the requirements of paid sick leave laws, where applicable. For information about PTO, see https://one.walmart.com/notices. Live Better U is a Walmart-paid education benefit program for full-time and part-time associates in Walmart and Sam's Club facilities. Programs range from high school completion to bachelor's degrees, including English Language Learning and short-form certificates. Tuition, books, and fees are completely paid for by Walmart.
Eligibility requirements apply to some benefits and may depend on your job classification and length of employment. Benefits are subject to change and may be subject to a specific plan or program terms.
For information about benefits and eligibility, see One.Walmart.
LOCATION
Herndon, Virginia US-10710: The annual salary range for this position is $108,000.00 - $216,000.00
Bentonville, Arkansas US-09050: The annual salary range for this position is $90,000.00 - $180,000.00 Additional compensation includes annual or quarterly performance bonuses. Additional compensation for certain positions may also include:
- Stock
Minimum Qualifications
Option 1: Bachelor's degree in computer science, information technology, engineering, information systems, cybersecurity, or related area and 3 years’ experience in incident response or related area at a technology, retail, or data-driven company. Option 2: 5 years’ experience in incident response or related area at a technology, retail, or data-driven company.
Preferred Qualifications
Certifications in Security+, Network+, GISF, GSEC, CISSP, CCSP, or GCIH, Master’s degree in Computer Science, Information Technology, Engineering, Information Systems, Cybersecurity, or related area and 1 Years' Exposure of leading/working on Information Security/Cyber Security Projects. We value candidates with a background in creating inclusive digital experiences, demonstrating knowledge in implementing Web Content Accessibility Guidelines (WCAG) 2.2 AA standards, assistive technologies, and integrating digital accessibility seamlessly. The ideal candidate would have knowledge of accessibility best practices and join us as we continue to create accessible products and services following Walmart’s accessibility standards and guidelines for supporting an inclusive culture. CISSP - Certified Information Systems Security Professional - Certification.
Walmart and its subsidiaries are committed to maintaining a drug-free workplace and has a no tolerance policy regarding the use of illegal drugs and alcohol on the job. This policy applies to all employees and aims to create a safe and productive work environment.
See all Incident Response Engineer jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Incident Response Engineer roles.
Get Access To All JobsTips for Finding STEM OPT Authorization as an Incident Response Engineer
Verify your CIP code before applying
Confirm your degree's Classification of Instructional Programs code maps to a STEM-designated field like Computer Science or Information Security. Your DSO can check your I-20 against the official STEM CIP list, a mismatch disqualifies you from the 24-month extension regardless of your job duties.
Screen employers for E-Verify enrollment early
Incident Response Engineer roles often sit inside security or IT operations teams at companies that don't always advertise their E-Verify status. Ask the recruiter directly during a first call, STEM OPT is void if your employer isn't enrolled in E-Verify before your extension start date.
Negotiate your I-983 training plan before accepting
Your employer must complete Form I-983 detailing how your Incident Response duties connect to your STEM degree. Raise this before signing an offer, some hiring managers in security operations have never filed one, and delays getting it signed can push your extension start date.
Use Migrate Mate to target verified sponsors
Search Incident Response Engineer roles on Migrate Mate, which filters for employers with confirmed E-Verify enrollment and active STEM OPT hiring history. This cuts out the manual verification step and surfaces companies already familiar with the I-983 and 24-month extension process.
Map your resume to O*NET's IR Engineer tasks
Pull the Incident Response Engineer occupation profile from O*NET and align your resume skills to its listed tasks: threat containment, forensic investigation, and post-incident reporting. Employers filing STEM OPT extensions reference SOC codes, so matching your experience to standard task language strengthens your I-983 training plan.
Time your H-1B registration around your OPT end date
If your STEM OPT extension runs through an H-1B lottery cycle, cap-gap protection automatically extends your work authorization if you're selected. Submit your registration in March during your final OPT year so any cap-gap gap between October 1 and your extension's expiry is covered by USCIS rules.
Incident Response Engineer jobs are hiring across the US. Find yours.
Find Incident Response Engineer JobsFrequently Asked Questions
Does an Incident Response Engineer role qualify for the STEM OPT extension?
Yes, if your underlying degree carries an eligible STEM CIP code and your job duties in threat detection, digital forensics, or security operations directly relate to that field. The role itself doesn't confer eligibility, your degree does. Confirm the CIP code on your I-20 with your DSO before your employer files the I-983 training plan, since USCIS evaluates the degree-to-job connection during any request for evidence.
What does my employer need to do before my STEM OPT extension starts?
Your employer must be enrolled in E-Verify and must sign Form I-983, the Training Plan for STEM OPT Students, before your extension begins. The I-983 requires them to document how your Incident Response duties relate to your STEM degree, set learning objectives, and attest that the position is paid and meets labor standards. You then submit the signed I-983 to your DSO, who issues a new I-20 for the USCIS extension filing.
How do I confirm a company is enrolled in E-Verify before accepting an offer?
Ask the recruiter or HR contact directly whether the company is enrolled in E-Verify. Employers can also be searched through the E-Verify employer search tool maintained by DHS. For security-sector companies that may have government contracts, E-Verify enrollment is often mandatory by federal regulation, but enrollment still needs confirmation, don't assume based on company size or contract status alone.
Which STEM degrees typically support an Incident Response Engineer STEM OPT extension?
Degrees in Computer Science, Information Security, Cybersecurity, Computer Engineering, and Electrical Engineering commonly carry eligible STEM CIP codes. Some programs in Management Information Systems or Applied Mathematics also qualify depending on the specific CIP code your school assigned. A degree titled broadly, like Information Technology, may or may not qualify, so verify the exact CIP code on your I-20 against the DHS STEM Designated Degree Program List before counting on the extension.
Where can I find Incident Response Engineer jobs where employers are already set up to hire STEM OPT students?
Migrate Mate lists Incident Response Engineer positions filtered for employers with E-Verify enrollment and documented STEM OPT hiring activity. That saves you from discovering mid-offer that a company has never processed an I-983 or isn't enrolled in E-Verify. Targeting employers who have already navigated the training plan process significantly reduces the risk of delays between your OPT expiry and extension approval.
See which Incident Response Engineer employers are hiring and sponsoring visas right now.
Search Incident Response Engineer Jobs